Subject: Re: Huge CRLs

From: "Bob Jueneman" <[email-masked]>
Date: Tue, 14 Sep 1999 09:28:37 -0600

On the other end of the time spectrum, try using OCSP, or any other protocol other than CRLs, in disconnected mode while you are on an airplane reading your signed e-mail.

Bob

>>> Robert Moskowitz <[email-masked]> 09/13/99 04:44AM >>>
At 10:29 AM 9/10/1999 -0400, [email-masked] wrote:

>CRLs in any form are a fundamentally inadequate approach to solving practical 
>problems and in most cases cannot meet business requirements for even small 
>scale infrastructures.  CRLs were a good idea when the terribly impractical 
>people who developed them were working on paper and not such a great idea 
>when you have to turn paper into production systems.   CA revocations 
>experiments done on practical deployments (real world machines, apps, and 
>users) of even small PKIs will demonstrate that complying with your own 
>policy won't happen in the real world if you base your revocation hopes on 
>CRLS.
>Why are you messing with them?
>
Try addressing REALTIME validation.  OCSP caching MIGHT work, but an IPsec
device has millisecs to validate; no time for network latency to retrieve info.

Robert Moskowitz
ICSA
Security Interest EMail: [email-masked]

---

From: "Ambarish Malpani" <[email-masked]>
Date: Tue, 14 Sep 1999 14:41:49 -0700

Bob, there are actually 2 ways I would address that:

1. Your mail server could do the validation and only send you
messages that were validated (assuming you trust your mail server
*and* your mail server has the same cert validation rules as you
do).

2. You could use the "Freshness Seal" method, where the sender of
the mail (or the mail server), gets the revocation status proof
and sends it to you with the message.

In either case, the proof is obtained by somebody who is online.
You get the proof when you go online to get the mail message. You
can digest the proof in the "luxury" of your plane seat!

Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
1215 Terra Bella Ave.                         http://www.valicert.com
Mountain View, CA 94043-1833

> -----Original Message-----
> From: Bob Jueneman [mailto:[email-masked]]
> Sent: Tuesday, September 14, 1999 8:29 AM
> To: [email-masked]; [email-masked]; [email-masked];
> [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked]; [email-masked];
> [email-masked]
> Subject: Re: Huge CRLs
> 
> 
> On the other end of the time spectrum, try using OCSP, or any 
> other protocol other than CRLs, in disconnected mode while 
> you are on an airplane reading your signed e-mail.
> 
> Bob
>

---

From: Stephen Kent <[email-masked]>
Date: Wed, 15 Sep 1999 15:57:43 -0400

Ambarish,

>can digest the proof in the "luxury" of your plane seat!

Note that the S/MIME RFCs describe a facility for the sender to include
CRLs (as well as certs) along with the message.  In many instances this
would provide a pretty reasonable basis for cert validation, and does not
require that one rely on a mail sever to perform the check nor on the
creation of a way to pass an OSCP token.  Of course, big CRLs might be
awkward here, but given the size of many message attachments ...

Steve