[lamps] Request time in CMC

[Stefan Santesson <[e-mail]>]

I posted this in PKIX but I realize that this may be an issue that could
be discussed/handled in this group as it is somewhat related to CMS.

I'm working on a project where we use CMC for some simple direct
interaction between an RA and a CA.

We got stuck on replay protection that is essential for us. For this
purpose there is a nonce value, but no time when the request message was
created.

Without time information, replay protection will potentially have to
save and check against all nonces for eternity, which seems highly
inefficient.


Our current solution is to create a new CMC control attribute with the
ASN.1 structure of GeneralizedTime defined as the "messageTime"

(The term message time is used in the CMC document even though it is not
included in the protocol)


Questions:

Are we correct or wrong in our assumptions?

If we are correct, could LAMPS provide an OID for such control attribute?

Or has such attribute already been defined elsewhere?

I could write a short draft if this group would agree to define such
attribute. It would be a very short draft.


________________
Stefan Santesson