Subject: Re: Huge CRLs

From: "Aram Perez" <[email-masked]>
Date: Tue, 14 Sep 1999 09:16:21 -0700

Bob,

In either case you are stuck with the same problem: you don't know whether
the signer's certificate is valid until you get the next "certificate
status" update, whether you get the status via a CRL or OCSP.

BTW, if you weren't on-line, how did you get the signed e-mail? ;-)

Regards,
Aram Perez

> On the other end of the time spectrum, try using OCSP, or any other
> protocol other than CRLs, in disconnected mode while you are on an airplane
> reading your signed e-mail.
>
> Bob
>
>>>> Robert Moskowitz <[email-masked]> 09/13/99 04:44AM >>>
> At 10:29 AM 9/10/1999 -0400, [email-masked] wrote:
>
>>CRLs in any form are a fundamentally inadequate approach to solving practical
>>problems and in most cases cannot meet business requirements for even small
>>scale infrastructures.  CRLs were a good idea when the terribly impractical
>>people who developed them were working on paper and not such a great idea
>>when you have to turn paper into production systems.   CA revocations
>>experiments done on practical deployments (real world machines, apps, and
>>users) of even small PKIs will demonstrate that complying with your own
>>policy won't happen in the real world if you base your revocation hopes on
>>CRLS.
>>Why are you messing with them?
>>
> Try addressing REALTIME validation.  OCSP caching MIGHT work, but an IPsec
> device has millisecs to validate; no time for network latency to retrieve
info.
>
> Robert Moskowitz
> ICSA
> Security Interest EMail: [email-masked]
>