freshness about draft-ietf-rats-daa HOT 3 OPEN

In most regards, DAA is a normal signature, so it can be used in a challenge-response protocol with a nonce from a verifier or by adding a time-stamp to achieve freshness. The anonymity of the DAA signature is not affected. If necessary, this can be made clearer in the document.

from draft-ietf-rats-daa.

I'm thinking about the possibility that the challenger injects identifying information in to the nonce (e.g., the network address of the attester it is connected to). And that identifying information is sealed into the produced Evidence and can be consumed at a later time by a third party to reveal the attester. Is the assumed trust/threat model such that the challenger cannot be an attacker in any case? I'd think so, but it's better to state that explicitly.

from draft-ietf-rats-daa.

The Attester can retain anonymity if it doesn't reveal any identifying / instance information (such as ip addr). If that is the case, the challenger will not be able to arrive at a nonce value that can distinguish between a first and second Attester vs. two instances of the first Attester. This means the nonce is no better than random at distinguishing between different Attesters and the same Attester. Since, the conveyance protocol might disclose a conveyance endpoint identifying information, some form of obfuscation of such identifiers is needed such as TOR for IP networks.

from draft-ietf-rats-daa.