3 ms·
Wouldn't a CRL that lists all the revoked certificates tell you that exact same information?
by Thorrez 4y ago
Wouldn't a CRL that lists all the revoked certificates tell you that exact same information?
- OrvalWintermute 4y agoCRL's format is to list all the serial numbers in a blacklist, which means a CRL for a large well-used PKI is going to be gigantic by comparison to an MHT. A CRL is not equivalent to modern OCSP, because modern OCSP can operate as a whitelist or a blacklist. However, CRLs are generally more secure than some of the OCSP variants because strong OCSP is used less (Nonced+authenticated/registered), and CRLs are not subject to replay attack like vanilla OCSP can be.