Re: [pkix] Optimizing OCSP - Time for some spec work ?

[Kurt Roeckx <[e-mail]>]

On Thu, Oct 24, 2019 at 08:53:59AM -0600, Dr. Pala wrote:
> Our work is focusing on two considerations:
> 
>  * Optimizing for the common case (non-revoked certificate). In
>    particular, for certificates that have no revocation information, we
>    do not have to provide specific responses for each individual
>    certificate (as we do in the revoked case), but we can provide
>    responses for ranges of certificates where the status is not
>    revoked. In a PKI with a population of 100M certificate and a
>    revocation rate of 5%, using "range" response types reduces the need
>    for calculating OCSP responses from 100M to 1M (i.e. 2N + 1 where N
>    is the population of revoked certificates). This allows to
>    pre-generate responses more quickly, allows for lower costs of
>    running the revocation infrastructure, and it is better for the
>    planet :D

I don't see how that can work if you're not allowed to return good
for a non-issued certificate and that the serial numbers should
be random.


Kurt