Re: NR, redux, again.

[Tony Bartoletti <azb@xxxxxxxx>]

At 12:23 PM 11/2/99 -0500, tgindin@us.ibm.com wrote:
>
>[Tom Gindin]   CRL archiving is all the CA needs to do to support NR.  That
>does not mean that it is all that must be done for NR.

Hmmm.  Regarding the CA, that depends on what one expects from NR.

Question:  What exactly does CRL archiving do for you?
Answer:    You can establish that CA-x held Cert-y valid at time t.
           Would you need to have your own timestamped archive of the
           the CA's (public) CRL-signing key taken while it was itself
           valid, to be more comfortable?

If this is exactly what the "NR-bit" will imply, then it should be
called the "CRL-Archive-bit" and the debate about its implications
will be greatly reduced.

But I am missing something here.  To "NR" a transaction, I will need the
(supposedly) signed elements of the transaction to be timestamped and
archived at (near?) the time of transaction, true?  In particular, the
NR-service (at the outset) would test that the supposed EE-signature
actually verifies with a cert valid according to a current CRL.
(Else a revoked and "discarded key" might be used to forge a pre-dated
element.)  But if the NR-service must archive "some" elements at/near
the transaction time, then why not the relevant CRL itself?

Still, I ask myself "Is this all that I want from a CA in support of an
NR-transaction?"  Would I not want some "better" assurance, or evidence
that the EE who was issued this key was who they claimed to be?

Put another way, if I were a sloppy CA, handing out certs blindly,
(and my CP/CPS admits as much) but I dutifully archive my CRL's,
would my signing of an NR-bit on a cert be of any real value to
the individual (RP) who wants a transaction to be NR?  Would not
the RP be laughed out of court once the CP/CPS was entered into
evidence?  And contrastingly, if the CP/CPS were strong, wouldn't
that document need to be timestamped/archived circa the transaction?

___tony___  

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: azb@llnl.gov                                   LLLLLLLL