<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<br>
<div class="moz-cite-prefix">On 13/1/2022 8:02 μ.μ., Ian McMillan
via Cscwg-public wrote:<br>
</div>
<blockquote type="cite"
cite="mid:0100017e549af3b4-bdc31d6c-3b8e-4bf2-8eed-1480b5515916-000000@email.amazonses.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}div.WordSection1
{page:WordSection1;}ol
{margin-bottom:0in;}ul
{margin-bottom:0in;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Hi Folks,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I followed up to make sure we have the
behavior for Windows understood. WVT (WinVerifyTrust) will do
revocation checking for the TSA cert and if timestamped with
that TSA, and it will consider the signature as invalid even
if the signing cert is still valid at the time of checking.
Corey’s point about the broad usage leads to larger impact in
the revocation scenario does play a large factor and why I
would like to see the TSA entity certificate max validity come
down to 15 months, and we remove the rekey requirement. </p>
</div>
</blockquote>
<br>
Hello Ian,<br>
<br>
Thank you for the feedback about WVT, it's very useful. I believe
most CAs prefer to have the Time-stamping Issuing CA offline
(treated as a Root) because I assume we weren't sure if the
timestamp validation extends to the certificate of the Issuing CA.
Can you also please confirm that the validity of the Time-stamping <b>Issuing
CA Certificate</b> (at the subCA level) is checked by WVT? <br>
<br>
If Windows checks for the validity of the issuing CA Certificate,
some CAs might consider bringing the TSA Issuing CA online.<br>
<br>
Thanks,<br>
Dimitris.<br>
</body>
</html>