3 ms·
I wanted to point out that this is specific to certain perspectives. The perspective within the US government, where there continues to be a robust investment
by OrvalWintermute 2y ago
I wanted to point out that this is specific to certain perspectives.
The perspective within the US government, where there continues to be a robust investment in a fully deployed system of OCSP Responders, repeaters and caching systems providing both OCSP AND CRLs is different.
This system has greater performance and greater security than an equivalent "CRL-only" type of system.
It is true that certain PKIs have negative economies around services, and have underinvested in the infrastructure they need to provide.
PKI standards in general were not written for the modern threat environment which includes grave privacy risks.
For forward deployed use-cases, and expeditionary forces, OCSP provides valuable tradeoffs in conjunction with CRLs, particularly when used to maximize each's benefit for particular use-cases.
Would be happy to discuss this with anyone