3 ms·
It’s better with a trade off. It removes the call-home to Apple, but adds the possibility of false positives for certificate revocation. Is this in fact the tr
by chrisshroba 6y ago
It’s better with a trade off. It removes the call-home to Apple, but adds the possibility of false positives for certificate revocation.
Is this in fact the trade-off we’re considering, or am I misunderstanding?
- sirsar 6y agoYou are misunderstanding. The bloom filter is only a preliminary check; if it indicates a revoked certificate, you then verify that it's a true positive the traditional way.
- chrisshroba 6y agoOh of course. Thank you for clearing that up for me.
- adinisom 6y agoI think the idea is that false positives (cert revoked) result in a call home to Apple for an actual check. The other idea is that because Apple knows all existing certificates, they could conceivably construct filters that have no false positives for those existing certificates... sort of like construction of a perfect hash.