Subject: RE: Rationale for Nonce in Time Stamp Protocol

From: [email-masked]
Date: Thu, 1 Jun 2000 13:18:51 -0400

Saying only "or" instead of "and/or" would be fine with me.

Francois
___________________________________
Francois Rousseau
Director of Standards and Conformance
Chrysalis-ITS
1688 Woodward Drive
Ottawa, Ontario, CANADA, K2C 3R7
[email-masked]      Tel. (613) 723-5076 ext. 419
http://www.chrysalis-its.com     Fax. (613) 723-5078

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]]
Sent: Wednesday, May 31, 2000 10:52 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: Rationale for Nonce in Time Stamp Protocol

François,

> Salut Denis,
> 
> I agree with both the word change and the proposed pointer.
> 
> However, I still think that leaving the term "timeliness" in Section 2.2
> could be misinterpreted to mean that a requesting entity MUST reject a
> totally valid response because of possible delays in the intervening
network
> elements and/or a drifting of this requesting entity own local time
> reference.
> 
> According to Section 2.2, what would a requesting entity be required to do
> if he/she receives a time stamp token with the right hash value and nonce,
> however the time included in the response is before or very much later
than
> his/her own local trusted time reference?

The current sentence is:

 ... by verifying *either* the time included in the response against
a local trusted time reference, if one is available, *and/or* the
value of the nonce (large random number with a high probability that
it is generated by the client only once) included in the response
against the value included in the request.

Instead of "and/or", we could say "or". Would this solve your
concern ?

Denis