Subject: RE: Huge CRLs

From: [email-masked]
Date: Tue, 14 Sep 1999 08:16:32 -0700

note also that  for the router/vpn/ipsec scenerio ... that direct analogy for
badged entry systems exists which come in both offline (aka certificate) on
online (possibly OCSP but also AADS ... i.e. certificate-less) deployments.

Both offline and online versions of badged entry systems currently exist meeting
different security and price objectives.

Also, CRL operation tends to be a scaleup issue proportional to the size of the
population ... and somewhat independent to the number of transactions &/or
connections. Online scaleup (at least for the router) tends to be much more
insensitive to the size of the population ... but more proportional to the
number of transactions.

However, the online flavor, is in fact, the scenerio used by 99% of the internet
routers today for authenticating connections ... i.e. RADIUS and like ilk use
online protocol for determining authentication ... and so an online protocol
would not be an enormous business process leap to the existing deployed
infrastructure (whether it was certificate or certificate-less based online
digital signature).