4 ms·

Quote: MTC also supports certificates that can be issued immediately and don’t require landmarks to be validated, but these are not as small. A server would

Quote: MTC also supports certificates that can be issued immediately and don’t require landmarks to be validated, but these are not as small. A server would provision both types of Merkle tree certificates, so that the common case is fast, and the exceptional case is slow, but at least it’ll work. I am not so sure about the "exceptional" part If the landmarks are generated not so often (say, once every couple of days), then the many clients will need to take the slow path If the landmarks is generated quickly (once per hour ?), then the client will continuously download those landmarks

bwesterb 1y ago
Landmarks are generated every hour, but I expect clients to pull them perhaps once or twice per day. Servers will keep two signatureless MTCs around a few days apart, so even if your client didn't update in a few days you can still use the small signatureless cert. The biggest reason for needing the big MTCs is for when you need a new certificate quickly. Our intern Lena had a look how common that would be, and she estimates it'd be required for 0.1% at any given time. https://www.youtube.com/watch?si=72ClhykaYDHf0sND&v=f8unMB2Qjho&feature=youtu.be https://www.youtube.com/watch?si=72ClhykaYDHf0sND&v=f8unMB2Q...