Slightly OT - i need the proper wording for a signed document
dirk.gottschalk1980 at googlemail.com
Sat Nov 3 16:43:21 CET 2018
Am Freitag, den 02.11.2018, 17:17 +0100 schrieb Wiktor Kwapisiewicz:
> On 02.11.2018 15:35, Dirk Gottschalk wrote:
> > I prefer GPG. And no, GPG does not lack timestamping, a timestamp
> > is
> > included in every signature.
> Signature creation date is not the same as timestamping. As for why
> you may consider the problem of validating signatures made by revoked
> keys. Without timestamping this kind of signature is inherently
> insecure (as the compromised key could be used by the attacker to
> created a backdated signature).
Yeah, I see what you mean. Right, that was out oif my sight.
> For example Authenticode uses timestamping  so that old signatures
> can still be considered valid even when the key expires or is revoked
> Adding something comparable to OpenPGP was discussed  on OpenPGP
> ML recently and previously .
Thanks for the information.
52064 Aachen, Germany
GPG: DDCB AF8E 0132 AA54 20AB B864 4081 0B18 1ED8 E838
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: This is a digitally signed message part
More information about the Gnupg-users