Time in CMC requests

We have an implementation of CMC (RFC 5272) that I need to use, but I
got stuck on replay protection.

CMC says that replay protection is handled by the use of nonce values.

However, without any time information when the request was created, I
would have to validate against an infinitely large bag of previous nonces.

Was this an oversight in the design, or am I missing something?

Is there any control message defined elsewhere that holds a time when
the CMC request was created?


My current options (as I need replay protection in this particular case)
is either to abuse the nonce data and use a byte encoded timestamp as
nonce, or to create a new control attribute with time information.

Any suggestions?



-- 
________________
Stefan Santesson