Re: [pkix] Optimizing OCSP - Time for some spec work ?

[Peter Gutmann <[e-mail]>]

Dr. Pala <[e-mail]> writes:

>However, I think there might be some theoretical approach we can also use to
>quantify benefits based on, at a minimum, projected size of the PKI and the
>number of revoked certificates: the lower the revocation ratio is (revoked
>certificates / total valid population), the lower the costs of pre-
>computation for the whole population is.

Right, and you could do that via simulation, or at least calculate, for
various values of X and Y, what the effects would be and at which point you
start to run into problems.  Then, if it looked feasible, you could perhaps
collect from CAs data on what real-world values of X and Y were likely to be.

>It is interesting to notice that this solution makes the costs associated
>with the revocation infrastructure to be directly correlated to the number of
>revoked certificates, instead of the number of issued certificates, thus
>shifting the paradigm quite a bit

Yup.

>In case there is interest, would you like to participate in the effort ?

It sounds interesting, but I don't think I'd have time for it, sorry.

Peter.