3.2.5.5.7 Posting a Secure Clock Challenge
The client posts a secure clock challenge as specified in section 2.2.2.3.
The client MUST be prepared to follow HTTP [RFC2616] redirections during the petition. If the secure clock server responds with "HTTP 301 (Moved)" or "302 (Redirect)", the client MUST use this redirect URL as the new secure clock challenge URL and start again by submitting the secure clock challenge to the redirected URL.
If the secure clock server responds with "HTTP 200 (OK)", the client reads the entire body of the response for the secure clock challenge URL. If successful, the client follows the procedure as documented in the section 3.2.5.5.5.
Upon receiving a secure clock response message, the device first base64-decodes the response as documented in [MS-DRM] section 2.2.1.1, putting the message into its raw XML format.
It then verifies the SIGNATURE element over the DATA element using the accompanying CERTIFICATECHAIN. The device MAY also verify that the certificates in the CERTIFICATECHAIN validate to a trusted certificate root for secure clock processing.
The SIGNATURE element MAY subsequently be validated against its own configuration data, which contains the public key of its configured secure clock server. In typical Windows Media Digital Rights Management (WMDRM): MTP Command Extension implementations, the secure clock server's public key is stored in the device certificate, and is retrieved by parsing the device certificate's SECURECLOCK XML node. The public key is located in the PUBLICKEY tag under the SECURECLOCK XML node.
Once the DATA element has been validated, the TID is validated against the TIDs of secure clock challenges previously issued by the device. If the TID cannot be located, the device MUST stop processing the secure clock response message.
Upon validating the TID, the device SHOULD synchronize its internal clock to the value in the GMTTIME element. The device SHOULD also store the time value from the REFRESHDATE element to indicate the time a new secure clock challenge is sent.