Subject: Re: [pkix] Previous attempt to update OCSP

From: Peter Gutmann <[email-masked]>
Date: Sat, 14 Aug 2010 00:30:55 +1200

"Al Arsenault" <[email-masked]> writes:

>What, specifically, will you accept as "proof" that revocation checking is
>used in the real world?

See my reply to the Verisign gentleman, my gripe was with the use of the
DoD/Federal PKI as "proof" of anything, not with any use or non-use of
revocation checking.

(Actually even for revocation checking I could nitpick, I've just checked the
digital signature on the Stuxnet trojan whose cert Verisign declared revoked a
month ago, and it's still regarded as valid on several machines I can get to
right now that have all security patches and updates applied and auto-updates
turned on.  The first machine I heard of that accepted the cert as revoked
took a mere week to do so, then some more regarded it as revoked two weeks
after Verisign declared it so, and of the machines I have acces to I can't
find any that regard it as revoked no matter what I try.  So I think it might
be fairer to claim that the pretense of revocation works, but the practice is
somewhat different).

Peter.