3 ms·
No. That isn't the same. CRLs and OCSP are about individual certificates. The beauty of Merkle Hash Trees for validation is it permits Statements e.g. CAx =
by OrvalWintermute 4y ago
No. That isn't the same.
CRLs and OCSP are about individual certificates.
The beauty of Merkle Hash Trees for validation is it permits Statements e.g.
CAx = CA2 and 156 ≤ X < 343 (5)
The statement cj indicates that the certificate with
serial number X = 156 issued by CA2 has been
revoked, while the certificates with serial numbers
from X = 157 to X = 343 (both included) issued by
CA2 have not been revoked.
From https://www.researchgate.net/publication/220066804_Certificate_revocation_system_implementation_based_on_the_Merkle_hash_tree https://www.researchgate.net/publication/220066804_Certifica...
- Thorrez 4y agoWouldn't a CRL that lists all the revoked certificates tell you that exact same information?
- OrvalWintermute 4y agoCRL's format is to list all the serial numbers in a blacklist, which means a CRL for a large well-used PKI is going to be gigantic by comparison to an MHT. A CRL is not equivalent to modern OCSP, because modern OCSP can operate as a whitelist or a blacklist. However, CRLs are generally more secure than some of the OCSP variants because strong OCSP is used less (Nonced+authenticated/registered), and CRLs are not subject to replay attack like vanilla OCSP can be.