2 ms·
CRLs don't scale, that's their problem and they take too long to update. Why isn't there a standard binary format for CRLs that is a cuckoo filter or a similar
by notepad0x90 2y ago
CRLs don't scale, that's their problem and they take too long to update.
Why isn't there a standard binary format for CRLs that is a cuckoo filter or a similar data structure? That way you don't have to worry about a CRL ballooning to gigabytes and you can expect clients to fetch the latest binary blob frequently.
- creatonez 2y ago> Why isn't there a standard binary format for CRLs that is a cuckoo filter or a similar data structure? We're getting there -- browser-summarized CRLs are available in Chrome and Firefox now - https://letsencrypt.org/2022/09/07/new-life-for-crls.html https://letsencrypt.org/2022/09/07/new-life-for-crls.html - https://blog.mozilla.org/security/2020/01/09/crlite-part-1-all-web-pki-revocations-compressed/ https://blog.mozilla.org/security/2020/01/09/crlite-part-1-a... - https://www.imperialviolet.org/2012/02/05/crlsets.html https://www.imperialviolet.org/2012/02/05/crlsets.html
- notepad0x90 2y agoNeat! and thanks for the response.
- less_less 2y agoAs a side project I also developed something like CRLite, but approximately 40% smaller: https://docs.rs/compressed_map/latest/compressed_map/ https://docs.rs/compressed_map/latest/compressed_map/ It's probably not state-of-the-art anymore, but it gets fairly close to the Shannon entropy of the {revoked, not revoked} distribution, supports non-Boolean types (like revocation reason), and is basically fast enough on both compression and queries. The main missing functionality is incremental update. To implement daily updates you'd just compress "which certs were revoked today", and to check a 50-day-old cert you'd do 50 queries. (The queries are really fast tho, so that's probably fine.)