Re: Time-stamping.

[Jean-Marc Desperrier <[e-mail]>]

Prashant Dambe wrote:

> Time-stamping of the dataum does not bind the time-stamped data to
> paticular user.So where it will be used as it does not bind creator
> identity. Any one canclaim that  I am the author of the document.
> Until there is specifically identificationof the creator inside the
> document itself.

So you need to include identification of the creator inside the document
you wish to time-stamp.

This part is plain evidence.
 > One way to do this is to to sign over dataum plus time-stamped
-data.> In this case user can replace the signature put its own
signature.> So Is not that time-stampng of signature value is
necessary.> And if the time-stamped signature value is placed as
unsigned attribute,> it can be also replaced and it is undetectable in
current specification.> So in the current draft IS time-stamp generated
fully secured?

Yes, if properly used.
But some clarification about how to use it properly might be needed.

As I discuss in my other message, you need, in most cases, to insert
inside the text that you wish to time-stamp, a reference to the time at
which you claim that the statement is true, before signing and then
time-stamping it.
No one should accept as valid a message without such a statement.
This reference does not need to be time-stamped, this is what you author
of the document, claim, and when you claim it.

In SMIME, this will be required by the standard.
There's the same requirement in "Technical Requirements for a
non-Repudiation Service".