how to avoid attack on Certificate Revocation List by the owner of the private key? suppose A owns the private key, and its correspondent certificate locates in site of CA. 

B request for A's certificate from CA for verifying the signature sent to him/her. 

There is an attack exists as follow:


A send message with signature to B.
A send revocation request to CA after confirming the message is successfully accepted.
B received the revocation information from CA. 
A repudiate the message.


As for it is totally possible that a private key owner keep using the key before he/she find the key has been compromised. So, in the above case A can successfully make repudiation.

My question, is the above attack really applied to real life ? how to avoid if so?

edit: under the assumption that the attack is raised intentionally by private key owner, it is totally different from the case that attacker use the time difference between A requests for revocation and B receives the inform, which can be mitigated by OCSP.
Yes one could do this, the repudiation wouldn't be very convincing.

The CRL really isn't very relevant. A person can always claim his private key was stolen. His credit card was stolen or his car was stolen. 
We see people commit hit and run, realize what they have done park the car somewhere and report it stolen. Denying a credit card transaction etc.
If the car is reported stolen well before the hit and run that would be convincing proof.

As with CRL it would be convincing if the revocation is clearly before the transaction. But a revocation very close in time to the transaction doesn't provide a very convincing repudation though theft is plausible it is not common. And the private key owner could still be held responsible for his private key. 

CRLs should not waive responsibility the second they are posted.