Memorisation by a remote site

What the clause says

The system should limit the ability of a remote site to store and replay an age determination attribute.

What it supplies to a comparison

Replay is a comparison criterion. A token that can be copied and reused weakens binding and freshness at once.

Evidence to keep

• The token lifetime and the replay protection.
• A replay test against a second session.

What the evidence looks like

For 8.1.3, the first artefact is The token lifetime and the replay protection.. The second is A replay test against a second session.. If 8.1.3 has no first artefact, the practice is unproven at 8.1.3, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. Can a captured result be replayed from another site?
2. How long does a result remain valid, and why?

How it connects to the draft

Memorisation by a remote site belongs to 8 security objectives, and it gives the analysis one fixed point: Replay is a comparison criterion. A token that can be copied and reused weakens binding and freshness at once. A comparison that cannot place a result against 8.1.3 is measuring something the framework has not defined, and the report should say so.

In the register, 8.1.3 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.