Post B7rehrd7IdtvBIFGue by vathpela@infosec.exchange
 (DIR) More posts by vathpela@infosec.exchange
 (DIR) Post #B7reTg2BcD4dADCroW by ariadne@social.treehouse.systems
       0 likes, 0 repeats
       
       @vathpela my understanding of the situation is that the larger problem will be when the signatures that CA has made expire.  afaik as long as signatures lay within the correct validity period, they are considered valid as long as they themselves haven't expired.  at least you would need it to work that way for offline verification, which UEFI secure boot has to support.
       
 (DIR) Post #B7rehrd7IdtvBIFGue by vathpela@infosec.exchange
       0 likes, 0 repeats
       
       @ariadne the validity period actually doesn't matter at all - everything on devices has checking them completely disabled, because a) all it can do is brick boxes (especially because of option rom signatures) and b) the attacker controls the clock.The only thing that cares about the validity period is SignTool.exe.  So basically now we can't get new bootloaders signed with the old cert, and generally distro's current bootloaders are dual-signed with the 2023 certs.The hard part is getting the 2023 certs enrolled before we need to revoke the current shims.