[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: CRLs versus short Validity periods
-----BEGIN PGP SIGNED MESSAGE-----
content-type: text/plain; charset=us-ascii
At 19:15 2/29/96, Bill Sommerfeld wrote:
>With short-lived certificates (possibly implemented as long-lived
>certificates which need to be "countersigned" periodically by an
>on-line CA), much more of the revocation infrastructure will be
>exercised on a regular basis, leading to a more robust system as a
>whole.
I think you ought to spell out the option of countersigning a long-lived
cert. To me, this is a cert whose attribute is "alive" only if combined
with a short-lived cert. That short-lived cert is then a positive
equivalent to the negative CRL. [presence of short-lived cert
== absense of short-lived CR]
Is this what you mean?
Exactly; the long-term certificate would be a replacement for/adjunct
to a privilege database kept by the on-line CA.
The on-line CA could be replicated, located near the servers that
cared about it, and set up to allow rapid "pushes" of revocation
information (so that applications need not be trusted to "pull" CRL's
on demand).
Depending on how the trust model is set up, the user's application
would present the short-term certificate given by the on-line CA, and
possibly the long term certificate as well.
- Bill
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBMTcoYlpj/0M1dMJ/AQF7NAP+MSVfCxs1X1saNRy8W1Vg4F4kfrzp7PVh
ILFpyaiT2ChASq8rtBq//DTCp/pzK2BZ6TINMXZ27q5yCNqeThlyHEG5DWnbJKl2
ObWBCT/APHioldP6xWFxMPT6PbzbKJukUQTz2yeRolZ34TL5st0KikhMuoOh4Sqc
GCmL3YkXDUk=
=cp72
-----END PGP SIGNATURE-----
References: