Certificate revocation and certificate update

摘要

We present a solution for the problem of certificate revocation.nThis solution represents certificate revocation lists by authenticatedndictionaries that support: (1) efficient verification whether ancertificate is in the list or not and (2) efficient updatesn(adding/removing certificates from the list). The suggested solutionngains in scalability, communication costs, robustness to parameternchanges, and update rate. Comparisons to the following solutions (andnvariants) are included: “traditional” certificate revocationnlists (CRLs), Micali's (see Tech. Memo MIT/LCS/TM-542b, 1996)ncertificate revocation system (CRS), and Kocher's (see FinancialnCryptography-FC'98 Lecture Notes in Computer Science. Berlin:nSpringer-Verlag, 1998, vol.1465, p.172-7) certificate revocation treesn(CRT). We also consider a scenario in which certificates are notnrevoked, but frequently issued for short-term periods. Based on thenauthenticated dictionary scheme, a certificate update scheme isnpresented in which all certificates are updated by a common message. Thensuggested solutions for certificate revocation and certificate updatenproblems are better than current solutions with respect to communicationncosts, update rate, and robustness to changes in parameters, and arencompatible, e.g., with X.500 certificates