I'm trying to wrap my head around the OCSP
revocationTime for D-Link's certificate.
I recently answered another question and ended up drafting a timeline.
That timeline is basically this:
Jul 5 00:00:00 2012 GMT. Validity: Not Before Feb 27 2015 Inadvertent disclosure --- six months of nothing --- Sep 3 00:00:00 2015 GMT. OCSP "revocationTime" backdated to this. --- one day of invalidity (?) --- Sep 3 23:59:59 2015 GMT. Validity: Not After Sep 17 2015 Tweakers.net report Sep 18 2015 TheRegister.co.uk report Sep 20 14:00 2015 Is-it-revoked-yet?-question posted. Sep 20 2015 Answer posted. OCSP `good` Sep 22 2015 Update answer posted. OCSP `revoked`
And the question is this:
- Does D-Link's move retroactively invalidate just 1 day of possible use/misuse of their key?
Or asked differently:
- Will an (hypothetical) EXE signed on Sep 2 with the stolen key STILL work, despite the revocation?
And as a side/background question:
- What is the general idea with OCSP's
revocationTime? Are you supposed to backdate that to the first point in time that you think the key was compromised? (I tried to do my research. But I'm stuck. I couldn't find the explanation in the OCSP RFC. And a 2012 post on the PKIX mailing list by Martin Rex, didn't exactly clear things up for me either.)