Re: Time in CMC requests

Hi Stefan,

Yes, time-stamped nonces is the way to go.

The only addition needed is a MAX_AGE (and MAX_FUTURE) check to keep the bag in shape.
I recently did this for a similar use case:
https://github.com/fido-web-pay/specification/blob/gh-pages/replay-cache-java.md

Anders

On 2021-10-26 18:29, Stefan Santesson wrote:
> We have an implementation of CMC (RFC 5272) that I need to use, but I
> got stuck on replay protection.
> 
> CMC says that replay protection is handled by the use of nonce values.
> 
> However, without any time information when the request was created, I
> would have to validate against an infinitely large bag of previous nonces.
> 
> Was this an oversight in the design, or am I missing something?
> 
> Is there any control message defined elsewhere that holds a time when
> the CMC request was created?
> 
> 
> My current options (as I need replay protection in this particular case)
> is either to abuse the nonce data and use a byte encoded timestamp as
> nonce, or to create a new control attribute with time information.
> 
> Any suggestions?
> 
> 
>