RE: WAP issues with XKMS [was RE: Mobile XKMS clients]

The current XKMS spec allows a validity period to be included for a response
so that a relying party can rely on cached responses. I believe that a nonce
is supported as well (i.e. with TransactionId) so that freshness within the
validity period (or in lieu of a validity period being used) is supported.

2.2.6 states "Techniques for protection against replay attacks MUST be
recommended in the security considerations section. Specific techniques
SHOULD be defined, such as nonce, origination time, and serial numbers in
requests, for example."  Unless I missed something, that was the only
related requirement. There's nothing specific about a validity period
though. We could add something like 

"The specification MUST define a validity period for public key status
responses so that when supported, clients may choose to rely on cached
responses." 

(or something like this).

Mike

-----Original Message-----
From: Stephen Farrell [mailto:stephen.farrell@baltimore.ie]
Sent: Tuesday, February 26, 2002 8:07 AM
To: www-xkms@w3.org
Cc: Deacon, Alex; 'Blair Dillaway'; Yassir Elley
Subject: Re: WAP issues with XKMS [was RE: Mobile XKMS clients]

<...snip...>

Anyway, my questions to you all are:-

- do we want to allow this type of thing? (now,later,never)
- is it allowed/prevented by the current requirements document?
- if not, what language to add to allow/prevent it?

Stephen.