3 ms·

If there were no certificate expiry, I could break into your system by finding some bankrupt company last trading in 1980 and stealing their keys to mint my own

If there were no certificate expiry, I could break into your system by finding some bankrupt company last trading in 1980 and stealing their keys to mint my own certificate. With expiry dates, at least the pool of places you can break into to steal certificate signing keys isn't growing without bound.

em-bee 1y ago
there is a difference between the expiration of signing keys, and the expiration of the signature signed with those keys. the signature for a contract, or a bootloader, should remain valid indefinitely, even if the person/key is no longer allowed to sign contracts/bootloaders after some point of time.
- josephg 1y ago
  That sounds impossible to enforce. Key signing is done offline. If I have an expired signing key, what’s stopping me setting my clock back a few years, creating a new signature and signing it? If the resulting key works indefinitely, the expiration date on my signing key is utterly meaningless.
  - withinboredom 1y ago
    And what stops people from just logging into the bios and changing the date or pulling the clock battery? The point we're all making here is, at least for this application, is that an expiration is pointless.
  - CaliforniaKarl 1y ago
    Trusted timestamp services. https://en.wikipedia.org/wiki/Trusted_timestamping https://en.wikipedia.org/wiki/Trusted_timestamping Microsoft's Authenticode has been doing this for a long time, allowing a signature to be considered as valid long after the signing certificate expired. https://learn.microsoft.com/en-us/windows/win32/seccrypto/time-stamping-authenticode-signatures https://learn.microsoft.com/en-us/windows/win32/seccrypto/ti...
amluto 1y ago
You can do almost as well by finding a piece of software with a code execution exploit early in boot that’s signed by the bank. A different model would be to only allow a given EFI binary to be booted if it was installed before the deadline, but that might well have a different set of complications.

em-bee 1y ago

there is a difference between the expiration of signing keys, and the expiration of the signature signed with those keys. the signature for a contract, or a bootloader, should remain valid indefinitely, even if the person/key is no longer allowed to sign contracts/bootloaders after some point of time.

josephg 1y ago
That sounds impossible to enforce. Key signing is done offline. If I have an expired signing key, what’s stopping me setting my clock back a few years, creating a new signature and signing it? If the resulting key works indefinitely, the expiration date on my signing key is utterly meaningless.
- withinboredom 1y ago
  And what stops people from just logging into the bios and changing the date or pulling the clock battery? The point we're all making here is, at least for this application, is that an expiration is pointless.
- CaliforniaKarl 1y ago
  Trusted timestamp services. https://en.wikipedia.org/wiki/Trusted_timestamping https://en.wikipedia.org/wiki/Trusted_timestamping Microsoft's Authenticode has been doing this for a long time, allowing a signature to be considered as valid long after the signing certificate expired. https://learn.microsoft.com/en-us/windows/win32/seccrypto/time-stamping-authenticode-signatures https://learn.microsoft.com/en-us/windows/win32/seccrypto/ti...

amluto 1y ago

You can do almost as well by finding a piece of software with a code execution exploit early in boot that’s signed by the bank. A different model would be to only allow a given EFI binary to be booted if it was installed before the deadline, but that might well have a different set of complications.