Re: ESSCertID in TSP

[Joerg Seidel <[e-mail]>]

Jean-Marc Desperrier wrote:
> 
> On day A, Alice borrows Bob2000$.
> She writes a statement "I owe Bob 2000$", digitally signs it, time-stamps the
> signature and gives it to Bob , saying : "See, I owe you 2000$, and this
> horodated statement proves it, digital signature, time-stamp, everything.
> 
> The next day, Alice borrows Bob 2000$ again.
> Alice writes a second statement "I owe Bob 2000$", digitally signs it,
> time-stamps the signature and gives it to Bob, saying : "See, I owe you 2000$
> again, and this new time-stamp "proves" that this is what I owe you today".
> 
> Of course it's very clear to everyone who has a good understanding of
> time-stamp, that this new time-stamping proves _nothing_.

Yes, now I see your point. You are totally right. The problem arises
because the timestamp proves only that the signature was made before a
given date, not at the date.

There are serveral ways to solve this problem. One of them is to
timestamp the document, sign the timestamp and timestamp the signature.
This proves that the signature was made between the two timestamp times.
Another is, as you stated already, to include the time in the document
or as a signed attribute in the signature.

What about this one:
"I owe the owner of this document 2000$". It is equivalent to a cheque
in the real world, but it has the value zero in any case, because there
is no way to identify the original. The signer can always claim that he
never gave the original to anyone - just copies.

Regards
Jörg
-- 
__________________________________________________________________

Jörg Seidel                             phone  [phone]
Director Technology                     fax    [phone]
timeproof GmbH                          
Harburger Schloßstraße 6-12             mailto:[e-mail]
DE 21079 Hamburg                        http://www.timeproof.de
__________________________________________________________________