4 ms·

> Why isn't there a standard binary format for CRLs that is a cuckoo filter or a similar data structure? We're getting there -- browser-summarized CRLs are ava

> Why isn't there a standard binary format for CRLs that is a cuckoo filter or a similar data structure? We're getting there -- browser-summarized CRLs are available in Chrome and Firefox now - https://letsencrypt.org/2022/09/07/new-life-for-crls.html https://letsencrypt.org/2022/09/07/new-life-for-crls.html - https://blog.mozilla.org/security/2020/01/09/crlite-part-1-all-web-pki-revocations-compressed/ https://blog.mozilla.org/security/2020/01/09/crlite-part-1-a... - https://www.imperialviolet.org/2012/02/05/crlsets.html https://www.imperialviolet.org/2012/02/05/crlsets.html

notepad0x90 2y ago
Neat! and thanks for the response.
less_less 2y ago
As a side project I also developed something like CRLite, but approximately 40% smaller: https://docs.rs/compressed_map/latest/compressed_map/ https://docs.rs/compressed_map/latest/compressed_map/ It's probably not state-of-the-art anymore, but it gets fairly close to the Shannon entropy of the {revoked, not revoked} distribution, supports non-Boolean types (like revocation reason), and is basically fast enough on both compression and queries. The main missing functionality is incremental update. To implement daily updates you'd just compress "which certs were revoked today", and to check a 50-day-old cert you'd do 50 queries. (The queries are really fast tho, so that's probably fine.)