[pkix] cross posting from LTANS: request for feedback/input on validate: verification data to store for signature verification after 50 years?

[Tobias Gondrom <[e-mail]>]

Hello dear PKIX fellows,

one quick invitation for input from PKIX on this:
http://tools.ietf.org/html/draft-ietf-ltans-validate-03

A number of people and regulatory bodies have asked "what verification
data do you need to store today to verify a signature in the future for
a potentially unlimited time - e.g. think of 50 years later (when trust
centers and OCSP responders may have gone silent)? (of course used
crypto algorithms in the signatures are renewed by using LTANS:ERS/XMLERS)"

So as one last minor item of LTANS (before we finally close it down in a
few months) we looked at one last informational draft "validate" to
answer that with some recommendations.

For example one of the questions is:
- is the package of the whole cert chain up to root of used signatures
and CRL/OCSPs sufficient, or do you also need to store the whole cert
chain up to the root for all signatures in the CRL/OCSP responses and
timestamp servers,especially in the case of published trust centres. And
to put this further: do you also need to store the OCSP for all used
certs in the OCSPs
- layer model vs. chain model for verification

We thought probably PKIX has already discussed parts of this problem in
the context of verification, in which case we would like to use the
input (or drop the validate-draft in total).

FYI: LTANS meets on Friday 1300-1400 in 0.4 Brussels. (input and
discussion is very welcome then and on the mailing-list).

Many greetings, Tobias
(co-chair of LTANS)


Tobias Gondrom
Sloan Fellowship 2009
London Business School
email: [e-mail]
mobile: [phone]