Subject: RE: Huge CRLs

From: "Ambarish Malpani" <[email-masked]>
Date: Wed, 15 Sep 1999 02:57:08 -0700

Hi Dave,
    A few incorrect statements in your mail:

1. OCSP can cover multiple certs in a single query (this is *not*
version 2 of the OCSP draft)

2. You could decide to implement an OCSP server that caches its
responses, or have a client cache OCSP responses, allowing you
to deal with stored certs also.

3. You are right about the ability to make CRLs or rather CRLDPs)
as large or small as you want to. If you make it too small (one DP
per cert) you end up with something worse than OCSP (because you
need to create a new DP for every cert, independent of whether
it is revoked or good). If you create responses on the fly, you
are really doing OCSP, but making the format of your responses look
like DPs - actually, OCSP does allow you to specify other response
type formats and I always thought people would want CRLs to be one
of the types - actually remember talking to Carlisle about it).

Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
1215 Terra Bella Ave.                         http://www.valicert.com
Mountain View, CA 94043-1833

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of David P.
> Kemp
> Sent: Tuesday, September 14, 1999 2:29 PM
> To: [email-masked]; [email-masked]
> Subject: RE: Huge CRLs
> 
[DELETED STUFF...]
> 
> 
> Phill,
> 
> Referring to last year's discussion is fine, but repeating last year's
> fallacies is not helpful when the topic resurfaces .
> 
> There is no dichotomy between "online" and "blacklist" style 
> revocation.
> Online is on one axis, the opposite end of which is store-and-forward.
> "List" is on an independent axis, namely the integers 1..N.
> 
> An OCSP response is online, and it covers a list of exactly 
> one certificate.
> 
> A CRL could be generated and retrieved online, or could be generated
> and stored for later retreival.  A CRL can cover any number of
> certificates, from N down to one. The requirement space covered
> is thus:
>                  OCSP  CRL
>                  ----  ----
> Online, 1 cert    y     y
> Online, N certs         y
> Stored, 1 cert          y
> Stored, N certs         y
> 
> 
> ---------- [from a later message] ----------
> 
> > The significance of OCSP is this. It is not sensible, practical or
> > ecconomic to build a revocation infrastructure which addresses
> > the planetary scale PKI at present while the size of the largest
> > PKIs is in the small millions. OCSP permits a decoupling of the
> > revocation/validation problem from the client implementation.
> 
> How is OCSP unique in this respect?  If you posit the existence of
> a revocation server findable by and trusted by the client, that server
> could return a CRL, or it could return an OCSP response.  The
> advantage of returning a list is that the client might not have to
> query as frequently.
> 
> 
> --------- [Lynn Wheeler adds] ----------
> 
> > Also, CRL operation tends to be a scaleup issue proportional to the
> > size of the population ...
> 
> Again, a matter of implementation.  The population covered by a CRL is
> a tunable parameter which can be set anywhere between 1 and the entire
> population.
> 
> 
> +-------------------------------------------------------------+
> + For information about the cert-talk mailing list, including +
> + archives and how to subscribe and unsubscribe, visit:       +
> +          http://www.structuredarts.com/cert-talk            +
> +-------------------------------------------------------------+
>