Subject: RE: Alternatives for Long Term Archiving

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 1 Apr 2004 08:32:03 -0500

Brian:

I do not think trusted archive requires providing date and time service.

If the trusted archive requirement is to attest to the date of any document,
then each TAA may put a date time stamp or get date-time stamp from an
authority and add proper trust anchors, certificates and revocation
information.

n of m only helps with integrity, availability, and provides protection
against perceived collusion threat.
 
-----Original Message-----
From: Brian Hunter [mailto:[email-masked]] 
Sent: Wednesday, March 31, 2004 6:41 AM
To: Larry Masinter
Cc: [email-masked]; [email-masked]
Subject: Re: Alternatives for Long Term Archiving

Larry or Santosh,

Could someone tell me how the n of m scheme replaces the need of an 
(accredited) time-stamping or time-marking service, when the date of 
document existance must be proved?  Is it assumed that each TAA simply 
states (and signs) when the document existed and when n TAAs state the 
same date, this date is correct and trustworthy?

Regards,
Brian

---

From: "Ulrich Pordesch" <[email-masked]>
Date: Thu, 1 Apr 2004 16:29:08 +0200

Santosh:

Getting a proof of existence of data at a certain time in the past using
(sequences/ chains of) time-stamps is an essential part of the service
and the reason, why we required this as "must requirement" in
requirements draft.
Getting trust relating to time- of existance by statements of a new kind
of trusted authorities (TAAs) is a completly other kind of trust. This
solution is not sufficient to conserve value of evidence of signed
documents in court, because there is no law (in germany but also
anywhere else, as I know), which recognizes trusted archives like
regulated/trusted time-stamp authorities. I think we will never get such
law, because complex archive systems can not be evaluated to the same
degree as simple time-stamping-machines.
Statements of TAAs, provided by protocol, may be an additional useful
features, if there are users who need it.

Ulrich

-----Ursprüngliche Nachricht-----
Von: [email-masked]
[mailto:[email-masked]] Im Auftrag von Santosh Chokhani
Gesendet: Donnerstag, 1. April 2004 15:32
An: [email-masked]
Betreff: RE: Alternatives for Long Term Archiving

Brian:

If the trusted archive requirement is to attest to the date of any
document, then each TAA may put a date time stamp or get date-time stamp
from an authority and add proper trust anchors, certificates and
revocation information.

-----Original Message-----
From: Brian Hunter [mailto:[email-masked]] 
Sent: Wednesday, March 31, 2004 6:41 AM
To: Larry Masinter
Cc: [email-masked]; [email-masked]
Subject: Re: Alternatives for Long Term Archiving

Larry or Santosh,

Regards,
Brian

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 1 Apr 2004 10:46:56 -0500

Ulrich:

To solve the problem, if the person who feels that the evidence may be
needed (e.g., the client) can obtain a time stamp, get all appropriate trust
anchors, certificates, revocation information attached, split n of m and
submit to the archives.  Then, when the evidence needs to reconstructed, n
TAAs can supply their shares to construct the original with all the
signatures and time stamps.

Why would that not be simple or meet the German Law?

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Ulrich Pordesch
Sent: Thursday, April 01, 2004 9:29 AM
To: [email-masked]
Subject: AW: Alternatives for Long Term Archiving

Santosh:

Getting a proof of existence of data at a certain time in the past using
(sequences/ chains of) time-stamps is an essential part of the service and
the reason, why we required this as "must requirement" in requirements
draft. Getting trust relating to time- of existance by statements of a new
kind of trusted authorities (TAAs) is a completly other kind of trust. This
solution is not sufficient to conserve value of evidence of signed documents
in court, because there is no law (in germany but also anywhere else, as I
know), which recognizes trusted archives like regulated/trusted time-stamp
authorities. I think we will never get such law, because complex archive
systems can not be evaluated to the same degree as simple
time-stamping-machines. Statements of TAAs, provided by protocol, may be an
additional useful features, if there are users who need it.

Ulrich

-----Ursprüngliche Nachricht-----
Von: [email-masked] [mailto:[email-masked]] Im
Auftrag von Santosh Chokhani
Gesendet: Donnerstag, 1. April 2004 15:32
An: [email-masked]
Betreff: RE: Alternatives for Long Term Archiving

Brian:

 
-----Original Message-----
From: Brian Hunter [mailto:[email-masked]] 
Sent: Wednesday, March 31, 2004 6:41 AM
To: Larry Masinter
Cc: [email-masked]; [email-masked]
Subject: Re: Alternatives for Long Term Archiving

Larry or Santosh,

Regards,
Brian

---

From: Jeff Williams <[email-masked]>
Date: Thu, 01 Apr 2004 22:05:59 -0800

Santosh and all,

  I can't invision how a trusted archive be devoid of an accurate
time stamp...

Regards,

--
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
"Be precise in the use of words and expect precision from others" -
    Pierre Abelard

"If the probability be called P; the injury, L; and the burden, B;
liability depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security
IDNS. div. of Information Network Eng.  INEG. INC.
E-Mail [email-masked]
 Registered Email addr with the USPS
Contact Number: 214-244-4827

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 2 Apr 2004 08:36:46 -0400

Jeff:

The idea is not that a rime stamp is not needed.  The client can obtain a 
time stamp.  Each TAA can obtain or assert a time stamp.  The assertion by 
TAA could be in the form of simply time or 3161 compliant time stamp.

On Thu, 01 Apr 2004 22:05:59 -0800, Jeff Williams wrote
> > If the trusted archive requirement is to attest to the date of any 
document,
> Spokesman for INEGroup LLA. - (Over 134k members/stakeholders 
> strong!) "Be precise in the use of words and expect precision from 
> others" -    Pierre Abelard
>

---

From: Jeff Williams <[email-masked]>
Date: Fri, 02 Apr 2004 18:45:35 -0800

Santosh and all,

Santosh Chokhani wrote:

> time stamp.

 This does not jive with your comments below.  However that aside,
obtaining a time stamp and one provided for at the time the archive
is created or the record is or was created and/or also archived,
is not the same as a obtaining one...

>  Each TAA can obtain or assert a time stamp.  The assertion by

  Again asserting and/or obtaining a time stamp is not the same as
one created at the time the record/records or archive is created...

Regards,

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 2 Apr 2004 23:54:19 -0400

Jeff:

What does not jive? Why can the client and/or the TAAs apply or obtain time 
stamp.  What is the reason for that not being godo enough?

On Fri, 02 Apr 2004 18:45:35 -0800, Jeff Williams wrote