<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"></div><div dir="ltr">This what I said in my (probably poorly written) mail. </div><div dir="ltr">This is not about immediate validity, but about validity at the time of signature. </div><div dir="ltr">In doc signing this is solved by adding the revocation status to the signature data, and I doubt cert consumers would do that. </div><div dir="ltr">Therefore, although I personally support suspension in general, I don’t think is feasible in this case. </div><div dir="ltr">P</div><div dir="ltr"><br><blockquote type="cite">Le 26 août 2022 à 16:26, Tim Hollebeek via Smcwg-public <smcwg-public@cabforum.org> a écrit :<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style>@font-face { font-family: "Cambria Math"; }
@font-face { font-family: Calibri; }
p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; }
span.EmailStyle18 { font-family: Calibri, sans-serif; color: windowtext; }
.MsoChpDefault { font-size: 10pt; }
@page WordSection1 { size: 8.5in 11in; margin: 1in; }
div.WordSection1 { page: WordSection1; }</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">I would love to hear from Certificate Consumers whether they are / are not interested in improving suspension in these ways. If they are, then perhaps this is worth working on. If they aren’t, then it would likely be a wasted effort.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">While thinking about this a bit more last night, I realized that the experience is probably even more a nightmare than I had anticipated, as the correct implementation would need to check whether the certificate was suspended at the time
the email was signed, not whether the certificate is currently suspended. I doubt it currently works that way in all current mail clients. Otherwise you can retroactively invalidate a whole bunch of signatures that happened way before whatever event triggered
the need for temporary suspension. I don’t even want to think about all the games you can play with asking for your certificate to be suspended temporarily whenever you want to manipulate whether your historical signatures validate successfully or not.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Tim<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<p class="MsoNormal">The SMCWG is about to create a new Guideline document with some industry-agreed principles and policies. The fact that things are not coordinated
<i>today </i>shouldn't prevent us from designing improvements for <i>tomorrow</i>. Perhaps some Certificate Consumers will decide to add the necessary development time and improve the existing implementations based on the SMBRs.
<br>
<br>
<o:p></o:p></p>
</div>
</div>
<span>_______________________________________________</span><br><span>Smcwg-public mailing list</span><br><span>Smcwg-public@cabforum.org</span><br><span>https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.cabforum.org_mailman_listinfo_smcwg-2Dpublic&d=DwICAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=PMqt7ItcI7EeoCkTw50-lhJvb_ZeCIKWMBCtkDqaB9A&s=kUu4WDWtTI8jqzgWN2kAOgvSgH3Lsee4_Ca5qjssKNY&e=</span><br></div></blockquote></body></html>