4 ms·
I lost several people at that point, so I clearly didn't communicate that point well. Sorry about that, I'll see if I can tweak it tomorrow. But the point was
by agl 15y ago
I lost several people at that point, so I clearly didn't communicate that point well. Sorry about that, I'll see if I can tweak it tomorrow.
But the point was that you can beat a Bloom filter on size, for the same performance, if you use only a single hash function (making the Bloom huge) and then compress the result.
Of course, you lose the random access in that case and, if you're looking at processing the whole thing for a lookup, then the volume of the uncompressed data becomes a concern. Thus the GCS...
- gorset 15y agoThanks. Which values are you using for the matching? I was assuming a fingerprint of the cert. Have you considered compressing the domains? Compiling them to a DFA should yield a very small structure, and you then will need far fewer bits for the actual fingerprint.
- agl 15y agoWe can only use the information that the CAs give us, which is the serial number of the certificate. So we match the serial number and issuer.
- MichaelGG 15y agoIf you use the domains, then any domain that ever had a cert revoked would hit, and need a secondary lookup. That means some of the busiest sites on the Internet would not benefit from this check. Also, I think if you re-issue or otherwise change your cert, the old one goes into the CRL, even if it wasn't for a compromise, right? (Which would explain a high number of revocations?)