1
$\begingroup$

suppose A owns the private key, and its correspondent certificate locates in site of CA.

B request for A's certificate from CA for verifying the signature sent to him/her.

There is an attack exists as follow:

  1. A send message with signature to B.
  2. A send revocation request to CA after confirming the message is successfully accepted.
  3. B received the revocation information from CA.
  4. A repudiate the message.

As for it is totally possible that a private key owner keep using the key before he/she find the key has been compromised. So, in the above case A can successfully make repudiation.

My question, is the above attack really applied to real life ? how to avoid if so?

edit: under the assumption that the attack is raised intentionally by private key owner, it is totally different from the case that attacker use the time difference between A requests for revocation and B receives the inform, which can be mitigated by OCSP.

Improve this question
$\endgroup$
4
  • $\begingroup$ "suppose A owns the private key, and its correspondent certificate locates in site of CA. B request for A's certificate from CA for verifying the signature sent to him/her" that's not generally how PKI-X works, the CA signs the certificate which can then be freely distributed to entities trusting the CA (certificate). $\endgroup$
    – Maarten Bodewes ♦
    Jan 26, 2018 at 10:26
  • $\begingroup$ Note that time-stamping and notaries may be used to enhance the signing process. It would probably be interesting to look at e.g. XAdES for more enhanced signing / verification schemes. $\endgroup$
    – Maarten Bodewes ♦
    Jan 26, 2018 at 10:28
  • $\begingroup$ OK, maybe this is the simplest theoretical certificate use model, but this is not the key point of my question, right? I think @Meir Maor's examples just hit the point. $\endgroup$
    – lihui
    Jan 26, 2018 at 11:47
  • $\begingroup$ I've helped Meir with the formatting and upvoted the answer even before that. The fact that I didn't post above comments as answer probably tells enough. The first comment is just to take away a misunderstanding in the first lines of your question, and the second is to indicate that there is more to non-repudiation than basic X.509 certificate based signatures. Your "key point" certainly can stand on it's own: this is not a critique on the question or answer. $\endgroup$
    – Maarten Bodewes ♦
    Jan 26, 2018 at 12:34

1 Answer 1

Reset to default
2
$\begingroup$

Yes one could do this, the repudiation wouldn't be very convincing.

The CRL really isn't very relevant. A person can always claim his private key was stolen. His credit card was stolen or his car was stolen. We see people commit hit and run, realize what they have done park the car somewhere and report it stolen. Denying a credit card transaction etc. If the car is reported stolen well before the hit and run that would be convincing proof.

As with CRL it would be convincing if the revocation is clearly before the transaction. But a revocation very close in time to the transaction doesn't provide a very convincing repudation though theft is plausible it is not common. And the private key owner could still be held responsible for his private key.

CRLs should not waive responsibility the second they are posted.

Improve this answer
$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.