Re: [lamps] The Status of OCSP and its future

[Tomas Gustavsson <[e-mail]>]

On 2019-10-25 09:14, Dmitry Belyavsky wrote:
> Dear Tomas,
> 
> On Fri, Oct 25, 2019 at 9:58 AM Tomas Gustavsson
> <[e-mail] <mailto:[e-mail]>>
> wrote:
> 
> 
> 
>     >
>     > Our approach stem from two practical considerations: the occasion to
>     > provide optimized responses for the non-revoked case, and the
>     > possibility to reduce the number of round trips required to
>     retrieve the
>     > revocation status for the full chain of certificates. In particular:
>     >
>     >   * /*Optimizing for the common case (non-revoked certificate).*/ In
>     >     particular, for certificates that have no revocation
>     information, we
>     >     do not have to provide specific responses for each individual
>     >     certificate (as we do in the revoked case), but we can provide
>     >     responses for ranges of certificates where the status is not
>     >     revoked. In a PKI with a population of 100M certificate and a
>     >     revocation rate of 5%, using "range" response types reduces
>     the need
>     >     for calculating OCSP responses from 100M to 1M (i.e. 2N + 1
>     where N
>     >     is the population of revoked certificates). This allows to
>     >     pre-generate responses more quickly, allows for lower costs of
>     >     running the revocation infrastructure, and it is better for the
>     >     planet :D
> 
>     What could a "range" of certificates be based on?
>     (I consider sequential serialnumbers to be dead by now)
> 
> 
> E.g. notBefore time?

That certainly works for partitioning, often used in partitioned CRLs of
course.