[e-signature] TimeStampReq has no nonce — timestamp responses can be replayed

[Yorizel]

Summary

The RFC 3161 TimeStampReq built by buildTimestampRequest does not include a nonce field. Without a nonce, a compromised or MITM-positioned server can replay a previous valid timestamp response, allowing an old timestamp to be embedded in a new signature.

Root Cause

timestamp.ts:164-176:

const timestampReq = sequence(
    integer(1),              // version = 1
    sequence(                // messageImprint
        sequence(oid(hashOid)),
        octetString(messageHash),
    ),
    asn1Boolean(true),       // certReq = TRUE
    // nonce is absent
);

RFC 3161 §2.4.1 defines:

TimeStampReq ::= SEQUENCE {
    version      INTEGER { v1(1) },
    messageImprint MessageImprint,
    reqPolicy    TSAPolicyId    OPTIONAL,
    nonce        INTEGER        OPTIONAL,
    certReq      BOOLEAN        DEFAULT FALSE,
    extensions   [0] IMPLICIT Extensions OPTIONAL
}

A random nonce ensures the response corresponds to this specific request. All three ICP-Brasil servers use HTTP, making MITM replay practical on untrusted networks.

Affected Files

• libraries/e-signature/src/timestamp.ts:164-176 — missing nonce in buildTimestampRequest

Suggested Fix

• Generate a random 8-byte nonce using crypto.getRandomValues:

  const nonce = crypto.getRandomValues(new Uint8Array(8));

• Add integer(nonce) to the TimeStampReq SEQUENCE before certReq
• Update extractTimestampToken to verify the nonce in the response matches (optional but recommended)

Note

This is a defense-in-depth measure. The timestamp token is cryptographically signed by the TSA, so replay requires the token to have the same messageImprint hash — only possible if the same document content is re-signed, limiting practical attack surface.