Suppose I have an Infopath form that is digitally signed today by a valid, and active user.
When that user leaves the company, we disable the account and revoke the certificate. This causes a problem since the old documents that were correctly signed are reported as being invalid.
How do we maintain the integrity of a PKI infrastructure and also ensure that the valid, prior signed documents still appear as valid within Infopath?
I don't know how Infopath works but your question is a general issue in the long term digital signature validation field.
The solution is to store along with the signature all information required to validate the signature (e.g. all certificate paths, downloaded CRL or OCSP responses...) and to wrap everything with a cryptographic time-stamp (as defined in RFC 3161). This time-stamp provides a proof of existence of all theses objects at the time-stamp date. Therefore it is possible to replay the signature validation process in the past (i.e. when the signing certificate was valid/not expired)
I've found this link http://msdn.microsoft.com/en-us/library/cc545900.aspx about digital signature in MS Office 2010 and it seems relevant for Infopath. You need a XAdES-X or XAdES-XL signature level, depending on how far in the future the signature should be validated.
Hope this helps.
PKI is about authentication (authn) and identity, and doesn't address the whole authorization (authz) problem. It sounds like you're trying to rely on certification path validation to do more than it is designed to do.
Does Infopath provide no way to add other checks when it evaluates documents - like check a secure timestamp on the signature with other metadata on when the subject authenticated by the certificate was allowed to do what? Or are there not other ways to prevent properly authenticated, but unauthorized, subjects from signing documents? Then you could avoid revoking the certificate, but still be able to appropriately evaluate its use.
And of course, short validity periods will help.
