Re: [lamps] The Status of OCSP and its future

[Dmitry Belyavsky <[e-mail]>]

Dear Tomas,

On Fri, Oct 25, 2019 at 9:58 AM Tomas Gustavsson <
[e-mail]> wrote:

>
>
> >
> > Our approach stem from two practical considerations: the occasion to
> > provide optimized responses for the non-revoked case, and the
> > possibility to reduce the number of round trips required to retrieve the
> > revocation status for the full chain of certificates. In particular:
> >
> >   * /*Optimizing for the common case (non-revoked certificate).*/ In
> >     particular, for certificates that have no revocation information, we
> >     do not have to provide specific responses for each individual
> >     certificate (as we do in the revoked case), but we can provide
> >     responses for ranges of certificates where the status is not
> >     revoked. In a PKI with a population of 100M certificate and a
> >     revocation rate of 5%, using "range" response types reduces the need
> >     for calculating OCSP responses from 100M to 1M (i.e. 2N + 1 where N
> >     is the population of revoked certificates). This allows to
> >     pre-generate responses more quickly, allows for lower costs of
> >     running the revocation infrastructure, and it is better for the
> >     planet :D
>
> What could a "range" of certificates be based on?
> (I consider sequential serialnumbers to be dead by now)
>

E.g. notBefore time?

-- 
SY, Dmitry Belyavsky