3 ms·
This paper seems relevant. It describes a new CT log with additional revocation transparency. https://eprint.iacr.org/2021/818.pdf https://eprint.iacr.org/2021
by chaz6 2y ago
This paper seems relevant. It describes a new CT log with additional revocation transparency.
https://eprint.iacr.org/2021/818.pdf https://eprint.iacr.org/2021/818.pdf
For it to be useful, I imagine clients would need to query some central service every time it receives a certificate it has not seen before, which could potentially be a privacy concern. The only other alternative seems to be for clients to sync the entire revocation log, which would quickly grow in size.
- wongarsu 2y agoClients could sync a bloom filter of revoked certificates. If the client encounters a certificate that matches the boom filter it would still need to check some online service to see whether the certificate was revokes or was a false positive. But for most unrevoked certificates the bloom filter would already tell you that it isn't revoked. Another benefit over a pure online service is that when you get a new bloom filter you check all known certificates against it to mark known certificates for rechecking (in case they got revoked since you last visited that page)