[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: bootstrap of key-centric binding of person to key
At 12:35 PM 3/4/96 -0500, Carl Ellison wrote:
>>Subject: Re: CRLs versus short Validity periods
>At 12:42 3/1/96, Frank O'Dwyer wrote:
>>I think we basically agree here?
>
>Yes, I think we agree. There are applications/CAs for which CRLs are the
>clear performance winner. There are others for which short-lived certs are
>the clear winner.
I would like to further divide the CRL cases into what I will call the
"Pure Capability" CRLs and the "Revocation Authority" CRLs. The difference
is who you have to communicate with to check for Certificate Revocation.
In the Pure Capability case, the only communication is with that entity
which implements the authority. In the Revocation Authority case, there is
separate communication with some Revocation Authority.
Let me illustrate with an example: Assume we have a certificate which
means, "Is permitted to logon to host.xyz.com as root". If that is all
that certificate allows one to do, then it is sufficient to have
host.xyz.com act as the repository for certificate revocation for that
certificate. There is no extra network communication needed to check for
revocation over that needed to exercise the privilege of logging on as
root.
However, if there is a backup server which periodically backs up
host.xyz.com, and it recognizes the "logon as root" certificate as
authority to recover backups, then there needs to be a separate certificate
revocation authority. (It is not reasonable to assume that host.xyz.com
will be up when you need to recover backups.) This revocation authority
could still be implemented on server(s) local to xyz.com's network,
reducing the scaling and communication problems.
We could convert the backup system to issue certificates of the form,
"authority to recover backups from host.xyz.com". By making this change,
and having the backup system check for revocation, we would convert to the
pure capability model. We would could also gain the flexibility to make
separate certificates for recovering host.xyz.com's backups before and
after the date that the "owner" of the workstation changes.
Does this model resonate with anyone? Is it interesting enough that I
should continue to suggest ways of using it? Or should I just drop it?
Regards - Bill
------------------------------------------------------------------------
Bill Frantz | The CDA means | Periwinkle -- Computer Consulting
(408)356-8506 | lost jobs and | 16345 Englewood Ave.
frantz@netcom.com | dead teenagers | Los Gatos, CA 95032, USA