3 ms·
That sounds impossible to enforce. Key signing is done offline. If I have an expired signing key, what’s stopping me setting my clock back a few years, creating
by josephg 1y ago
That sounds impossible to enforce. Key signing is done offline. If I have an expired signing key, what’s stopping me setting my clock back a few years, creating a new signature and signing it?
If the resulting key works indefinitely, the expiration date on my signing key is utterly meaningless.
- withinboredom 1y agoAnd what stops people from just logging into the bios and changing the date or pulling the clock battery? The point we're all making here is, at least for this application, is that an expiration is pointless.
- CaliforniaKarl 1y agoTrusted timestamp services. https://en.wikipedia.org/wiki/Trusted_timestamping https://en.wikipedia.org/wiki/Trusted_timestamping Microsoft's Authenticode has been doing this for a long time, allowing a signature to be considered as valid long after the signing certificate expired. https://learn.microsoft.com/en-us/windows/win32/seccrypto/time-stamping-authenticode-signatures https://learn.microsoft.com/en-us/windows/win32/seccrypto/ti...