Re: when can an entry not appear on a CRL?

[Paul Koning <pkoning@xxxxxxxxx>]

It's not clear to me why it is useful to distinguish "short term" and
"long term" signatures and then define different validation algorithms 
for them.  For example, what property distinbuishes the two flavors?

On a related issue, if you use "time of signature generation" how do
you know what that is?  It can't just be the timestamp in the
signature, since that would allow the thief of a key which was revoked
at time T to generate a "valid" signature by constructing one with
signing time T-epsilon.

If I have independent evidence I trust that a signature is at least as
old as T2 where T2 >= T, my inclination would be to verify that the
certificate wasn't revoked at T2, and was valid during the interval
T..T2.   Without independent evidence about the time of signing, I
basically have T2==now, which gets me what you describe as the "short
term" algorithm.

	paul