Freshness of a credential

What the clause says

The system should let the relying party judge whether a credential or result is fresh enough for the decision at hand.

What it supplies to a comparison

Freshness is measurable as a timestamp and a validity rule. The comparison should check both, and should test an expired result.

Evidence to keep

• The timestamp and validity field in the result.
• The expired-result test.

What the evidence looks like

For 8.1.4, the first artefact is The timestamp and validity field in the result.. The second is The expired-result test.. If 8.1.4 has no first artefact, the practice is unproven at 8.1.4, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. How does the relying party know the result is current?
2. What is the maximum age of a result for this decision?

How it connects to the draft

Freshness of a credential belongs to 8 security objectives, and it gives the analysis one fixed point: Freshness is measurable as a timestamp and a validity rule. The comparison should check both, and should test an expired result. A comparison that cannot place a result against 8.1.4 is measuring something the framework has not defined, and the report should say so.

In the register, 8.1.4 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.