suppose A owns the private key, and its correspondent certificate locates in site of CA.
B request for A's certificate from CA for verifying the signature sent to him/her.
There is an attack exists as follow:
- A send message with signature to B.
- A send revocation request to CA after confirming the message is successfully accepted.
- B received the revocation information from CA.
- A repudiate the message.
As for it is totally possible that a private key owner keep using the key before he/she find the key has been compromised. So, in the above case A can successfully make repudiation.
My question, is the above attack really applied to real life ? how to avoid if so?
edit: under the assumption that the attack is raised intentionally by private key owner, it is totally different from the case that attacker use the time difference between A requests for revocation and B receives the inform, which can be mitigated by OCSP.