<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1549742727973_106453"><span id="yui_3_16_0_ym19_1_1549742727973_106476">Hi<br></span></div><div id="yui_3_16_0_ym19_1_1549742727973_106492"><span id="yui_3_16_0_ym19_1_1549742727973_106476"><br></span></div><div id="yui_3_16_0_ym19_1_1549742727973_106493"><span id="yui_3_16_0_ym19_1_1549742727973_106476">Just playing devil's advocate to be sure :) <br></span></div><div id="yui_3_16_0_ym19_1_1549742727973_106494"><span><br></span></div><div id="yui_3_16_0_ym19_1_1549742727973_106475"><span>cheers</span></div><div id="yui_3_16_0_ym19_1_1549742727973_106474"><span>denis</span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1549742727973_106473"><span>co-chair DB-WG</span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1549742727973_104070"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1549742727973_104075" style="display: block;"> <div style="font-family: Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1549742727973_104074"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1549742727973_104073"> <div dir="ltr" id="yui_3_16_0_ym19_1_1549742727973_104072"> <font id="yui_3_16_0_ym19_1_1549742727973_104071" size="2" face="Arial"> <hr id="yui_3_16_0_ym19_1_1549742727973_104076" size="1"> <b><span style="font-weight:bold;">From:</span></b> Edward Shryane <eshryane@ripe.net><br> <b><span style="font-weight: bold;">To:</span></b> Sandra Murphy <sandy@tislabs.com> <br><b><span style="font-weight: bold;">Cc:</span></b> denis walker <ripedenis@yahoo.co.uk>; db-wg <db-wg@ripe.net><br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, 11 February 2019, 19:56<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [db-wg] Proposal for restricting authentication concerning use of revoked and expired GPG ID's in key-cert objects<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1549742727973_104077"><br><div dir="ltr" id="yui_3_16_0_ym19_1_1549742727973_104078">Hi Sandy,<br clear="none"><br clear="none">according to the OpenPGP Message Format RFC (<a shape="rect" href="https://tools.ietf.org/html/rfc4880" target="_blank" id="yui_3_16_0_ym19_1_1549742727973_104079">https://tools.ietf.org/html/rfc4880</a>), the signature creation time is in UTC.<br clear="none"><br clear="none">3.5. Time Fields<br clear="none"><br clear="none"> A time field is an unsigned four-octet number containing the number<br clear="none"> of seconds elapsed since midnight, 1 January 1970 UTC.<br clear="none"><br clear="none">5.2.3.4. Signature Creation Time<br clear="none"><br clear="none"> (4-octet time field)<br clear="none"> The time the signature was made.<br clear="none"><br clear="none">Regards<br clear="none">Ed<br clear="none"><br clear="none"><div class="yqt3647583399" id="yqtfd03562"><br clear="none">> On 11 Feb 2019, at 19:29, Sandra Murphy <<a shape="rect" ymailto="mailto:sandy@tislabs.com" href="mailto:sandy@tislabs.com">sandy@tislabs.com</a>> wrote:<br clear="none">> <br clear="none">> I’m surprised at the question. I don’t know PGP/GPG all that well, but I checked and the IETF standard for X-509 certificates (RFC5280) requires CAs to use UTC in the signature time fields, and CMS (RFC5682) requires UTC in the SigningTime (in both cases, up to the year 2049). <br clear="none">> <br clear="none">> Does this become an issue because the signatures in the RIPE database are doing something different?<br clear="none">> <br clear="none">> —Sandy<br clear="none">> <br clear="none">> <br clear="none">>> On Feb 11, 2019, at 11:41 AM, Edward Shryane via db-wg <<a shape="rect" ymailto="mailto:db-wg@ripe.net" href="mailto:db-wg@ripe.net">db-wg@ripe.net</a>> wrote:<br clear="none">>> <br clear="none">>> Hi Denis,<br clear="none">>> <br clear="none">>>> On 11 Feb 2019, at 16:53, denis walker <<a shape="rect" ymailto="mailto:ripedenis@yahoo.co.uk" href="mailto:ripedenis@yahoo.co.uk">ripedenis@yahoo.co.uk</a>> wrote:<br clear="none">>>> <br clear="none">>>> Hi Ed<br clear="none">>>> <br clear="none">>>> Thanks for following up on this. Just one question, have you taken into account time zones? If an update is signed now in Dubai it is 19:51. If the update is processed on Amsterdam time, it is 16:51. Will this update fail because it is 3 hours in the future?<br clear="none">>>> <br clear="none">>>> cheers<br clear="none">>>> denis<br clear="none">>>> co-chair DB-WG<br clear="none">>>> <br clear="none">>> <br clear="none">>> Good question. We rely on the Bouncy Castle cryptography library to provide the signing time for the message, and it does appear to take the timezone into account.<br clear="none">>> <br clear="none">>> I tested by signing a message inside a virtual machine set to a different timezone (EST), and the signature creation time was correctly mapped to the local timezone (within a minute rather than hours).<br clear="none">>> <br clear="none">>> The signed updates in production appear to confirm this - only 24 messages were more than 1 hour old, out of 118,183 (from October to December 2018), and none of these appeared to be offset by a multiple of hours.<br clear="none">>> <br clear="none">>> Regards<br clear="none">>> Ed<br clear="none">>> <br clear="none">> <br clear="none"></div></div><br><br></div> </div> </div> </div></div></body></html>