[Secdispatch] Clarification for a question about OCSP caching from Nick (Cloudflare)

["Dr. Pala" <[e-mail]>]

Hi Nick, all,

at the end of the second presentation on lowering the costs of 
revocation, if I am not mistaken, your question/comment (Nick) was about 
the fact that Cloudflare hosts / serve most of the cached OCSP responses 
and that the system does not have issues.

I am not sure if this comment is pertinent to what we are trying to 
solve here... let me elaborate a bit more.

The work we have been doing around the proposed topic of work is aimed 
at /_lowering the cost of *generating* and *distributing* these large 
volumes of signed data_/ when there is actually no need for that. By 
optimizing the protocol to provide range responses (or other methods, if 
we decide to go with a different approaches), we can reduce the number 
of signatures needed from a CA and their distribution - very expensive 
operations.

In other words, the proposal is /_not aimed at fixing any caching 
issues_/ because, as you noticed in your comment, that works just fine. 
The proposal at hand, instead, is about fixing a problem that CAs are 
facing today - high costs of deploying and running such systems.

On the other hand, your comment made me think about the caching service 
you mentioned and its associated costs.

Is it a service for which your company charge CAs ? If so, would you be 
able to share what are currently the costs incurred by CAs to leverage 
your service ? (I totally understand if you are not willing to - after 
all, this is usually the secret sauce :D)

Last but not least, I also would like to point out that optimizing the 
revocation can also help open-source communities, small companies, 
universities, non-profit, etc. by enabling them to deploy cost-efficient 
systems that can provide good quality of service using less resources 
(computational, storage, network).

Please let me know,

Cheers,
Max

P.S.: If we could combine this idea with OCSP over DNS, we could really 
provide access to revocation technology for everybody, not just who can 
afford the price. Unfortunately we know how that discussion went, and I 
still think it is a very evident mistake not doing it  (I am still 
working on this in my spare time - I think it is of enormous value for 
emerging countries to have access to cheap secure technologies and, in 
my opinion, IETF is dropping / has dropped the ball on this for 
not-so-honorable reasons, I suspect...). I hope We can fix it in the 
open-source community.

-- 
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
OpenCA Logo