Re: [Rats] Nonce-based freshness for CMP/EST

I reviewed the diff for the new draft and had a couple of questions/comments. Added LAMPS since this originates there.

How are non-ASCII values intended to be handled in the various EvidenceHint options? 
Given the way EvidenceHint is used in the JSON example, would it be better to just define EvidenceHint as a UTF8String instead of as a CHOICE? This would be more consistent with the statement from the attestation draft that the “format and contents of the hint are out of scope of this document.”
Should EvidenceHint be included in the NonceResponse to indicate which verifier was elected? This seems necessary given the attester may include a hint in the EvidenceStatement. 
Similarly, why does the hint need to be in the NonceRequest? The CA is the relying party. It seems to me that it will use whatever verifier it wants (so inclusion in the response makes some sense, to inform the EvidenceStatement creation, but inclusion in the request seems a bit like the tail wagging the dog).
s/a test value/a text value
The statement “indicates the time the nonce is considered valid” should probably be “indicates the time after which the nonce is considered invalid” assuming a nonce would only be valid until the expiry time if not used already.
What should occur if the verifier refuses to supply a nonce of the requested length?

From: RATS <rats-bounces@ietf.org> on behalf of <hannes.tschofenig=40gmx.net@dmarc.ietf.org>
Date: Sunday, March 3, 2024 at 7:23 AM
To: 'rats' <rats@ietf.org>
Subject: [Rats] Nonce-based freshness for CMP/EST

Hi all,

I have just submitted a new version of the draft that describes how to add nonce-based freshness for certificate management protocols like CMP/EST. The solution relies on the CSR attestation specification.

Here is the updated draft:

https://datatracker.ietf.org/doc/draft-tschofenig-lamps-nonce-cmp-est/

As the recent mailing list exchanges have shown, there is room for more discussion about this freshness topic. FWIW I have requested an agenda slot in the LAMPS group.

Ciao

Hannes

_______________________________________________ RATS mailing list RATS@ietf.org https://www.ietf.org/mailman/listinfo/rats 