Subject: question about system time checking in CMP

From: [email-masked]
Date: Fri, 19 Mar 1999 18:28:20 GMT

Section 4.6.1 of CMP says "Upon receipt of the ccp [cross cert response]
message, the requester CA checks that its own
   system time is close to the responder CA system time, "

The information about the responder's system time seems to be in the
messageTime field of the ccp, which indicates when the message was
produced.

I'm trying to interpret and implement this check for freeware reference
code (Jonah). I have two questions.

1) Just what is this check supposed to indicate/prove?

2) So, is there some sort of reasonable check that freeware reference code
can make here? Between the time the messageTime was generated and a check
might be made, it had to transit the network, the recipient's host had to
be up, and the recipient server had to be up. If everything goes well, an
hour seems like plenty. But if there are network problems, maybe 4 hours.
And if there were host problems or host or server upgrades, which could
happen over the weekend, maybe 3 days? So, is the right check for reference
freeware 3 days? Which is what I personally incline towards, not knowing
the answer to my first question.

Thanks for any help.
     Mez