3 ms·
If the signature creation date is before the key expiration date, the signature is valid. If the signature creation date is after expiration, it is possible (mo
by jagged-chisel 3y ago
If the signature creation date is before the key expiration date, the signature is valid. If the signature creation date is after expiration, it is possible (more likely than before) that someone else discovered the private key and has signed the document.
Signing key expiration exists for the same reason certificate expiration exists: we create keys that are infeasible to discover with current methods, and create replacements as techniques advance. This encourages us to create stronger keys over time.
Had you failed to notice a key expiration from the 80s, you would assume the signature is valid - but most computing devices these days could have just generated the signature without the original key.
- upofadown 3y agoWhy would an attacker with access to the private key specify a signature creation date after key expiry? They can specify whatever date they want. >Had you failed to notice a key expiration from the 80s, you would assume the signature is valid ... If the algorithm is broken then the implementation should not support verification using that algorithm no matter the expiration date. An attacker can update the key's expiration date to whatever they want if the algorithm is broken.