Subject: RE: Our objections to draft ERS

From: Tobias Gondrom <[email-masked]>
Date: Thu, 8 Apr 2004 17:37:15 +0200

Libor,
 
to answer in place of Brian:
 
Your described scenario is perfectly right.
I would not have been able to explain it better: This is exactly what is
meant.
 
best regards
 
    Tobias

Brian,

> In your example, the whole CMS object, as in RFC 3126, should be
> given to the TAA for archiving.

I have one quite elementary question to verify if I understand well. See the
following example:

Today 2nd April 2004, I digitally sign the digital contract and I do not
have the TAA at my disposal at present. My certificate for the digital
signature verification will expire 30th April 2004. When signing acc. to
RFC-3126, I will add the non-signed attribute Electronic Signature
Timestamp, containing the time stamp acc. to RFC-3161 with the TSA
certificate (expire date 31st Dec. 2008), to the CMS message, containg the
digitally signed contract.

In 2007, I will start the TAA. In 1st May 2007, I will archive my agreement
(CMS message) into this TAA. This will create the ERS with the first
ArchiveTimeStamp, issued after 1st May 2007. This ArchiveTimeStamp is issued
with the issue date of the following root hast-tree - let's say 6th May
2007.

In 2020, I will submit this contract to the court as a proof. I am obliged
to prove the non-repudiation. This means, I will obtain the ERS from the
TAA, which can prove, that the whole CMS message has not been changed from
the first issuing of the  ArchiveTimeStamp in 6th May 2007 up to present.

Now, the CMS message will be verified the same way it would have been done
in 6th May 2007. It means, I will verify that the time stamp in the
non-signed attribute had a valid TSA digital signature in 6th May 2007. The
time stamp was issued in 2nd April 2004. I will verify if my personal
signature certificate was valid in 2nd April 2004..... Result: digital
contract is valid.

 2.4.2004               6.5.2007                               2020
-+----------------------+--------------------------------------+--
 <------------CMS validity------------->
                        <-----------------ERS validity----------->>>

Libor