3 ms·
It sounds close to what the article suggests Let's Encrypt is using internally to store/generate the CRL files, though the article doesn't get into a lot of tec
by WorldMaker 4y ago
It sounds close to what the article suggests Let's Encrypt is using internally to store/generate the CRL files, though the article doesn't get into a lot of technical details to tell exactly if that is the case.
- OrvalWintermute 4y agoNo. That isn't the same. CRLs and OCSP are about individual certificates. The beauty of Merkle Hash Trees for validation is it permits Statements e.g. CAx = CA2 and 156 ≤ X < 343 (5) The statement cj indicates that the certificate with serial number X = 156 issued by CA2 has been revoked, while the certificates with serial numbers from X = 157 to X = 343 (both included) issued by CA2 have not been revoked. From https://www.researchgate.net/publication/220066804_Certificate_revocation_system_implementation_based_on_the_Merkle_hash_tree https://www.researchgate.net/publication/220066804_Certifica...
- Thorrez 4y agoWouldn't a CRL that lists all the revoked certificates tell you that exact same information?
- OrvalWintermute 4y agoCRL's format is to list all the serial numbers in a blacklist, which means a CRL for a large well-used PKI is going to be gigantic by comparison to an MHT. A CRL is not equivalent to modern OCSP, because modern OCSP can operate as a whitelist or a blacklist. However, CRLs are generally more secure than some of the OCSP variants because strong OCSP is used less (Nonced+authenticated/registered), and CRLs are not subject to replay attack like vanilla OCSP can be.