RE: DPD & DPV requirements - to nonce or not to nonce?

[Peter Williams <peterw@xxxxxxxxxxxx>]

Steve, 

Thankyou for your dissmisive comments.

Thankyou also for your disclosure of what you know about 
the use of hash-trees in patents. Your introduction of 
timestamping IP into a thread on (timed) nonces was 
suprising, per se.

I deduce from the your many memos discussing (somewhat vaguely 
expressed) requirements that you personally see no real 
vulnerability in a validation server responding to 
replayed client requests. Perhaps you view it as a function
of the underlying transport to be guarding against availability
threats? 

As a model for the design of authenication elements of a DPV
service, which IETF protocol's use of signed, nonce and 
anti-replay handling do you view as examplary and a practice 
to be followed? I will summarize its design for the list. 

With this information, we can begin
to comprehend which security service DPV users will be invoking
when applying the digital signature mechanism. Understanding
the authentication requirements is a useful contribution
at this stage, given the current lack of perceived clarity 
on how intelligent the DPV client is supposed to be.

Peter.