Re: Online Certificate Revocation Protocol

[Paul Hoffman / IMC <[e-mail]>]

Using POP for revocation causes problems in two scenarios:

- I have deleted my private key and discover later that it was stolen 
but not used before I deleted it

- I have physically lost my private key to an attacker (such as my 
computer was stolen)

The latter is probably much more likely. Given that private keys are 
often (usually?) protected with crackable passwords, the loss of a 
computer to an attacker can be pretty disastrous. I assume that many 
CAs have out-of-band revocation mechanisms for this case, but they 
certainly would take a long time, and are probably difficult for a 
typical end user to find out about.

--Paul Hoffman, Director
--Internet Mail Consortium