[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

short-life certs vs. CRLs

>Subject: Re: bootstrap of key-centric binding of person to key


        thanks for spelling things out in your reply.

At 09:26 3/5/96, Mark S Feldman wrote:
>> The two methods [with CRL or without] are precisely equivalent, in terms of
>> meaning, but differ in performance depending on the behavior of the
>> validating application.  I plan to write this up more formally, shortly.
>I believe that there's a subtle distinction between the two [with CRL
>or without].  With CRLs, certificates will generally have a much
>longer validity period and there is a connotation that the validity
>period is appropriate for the certificate at hand.  CRLs identify the
>exceptions.  Without CRLs, their is no such connotation.  A
>certificate is good for a small validitiy period and that may be that
>or it may be re-signed n-hundred times in a row.
>I'm not sure if the connotation associated with long-lived certs is a
>good one, but I believe it follows the current paper model (i.e.,
>drivers license/id is good for for years, passport for 10, credit
>cards for one or two).

This is a good example of what I called, several messages back, a
psychological difference, as opposed to a functional difference.  If the
psychological difference is important, then one using short-life, non-CRL
certificates could have two datime fields in the certificate:


I'm inclined to believe in the value of the psychological difference, so I
would recommend having the two fields.

|Carl M. Ellison          cme@cybercash.com   http://www.clark.net/pub/cme |
|CyberCash, Inc., Suite 430                   http://www.cybercash.com/    |
|2100 Reston Parkway           PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 |
|Reston, VA 22091      Tel: (703) 620-4200                                 |