[lamps] Re: I-D Action: draft-ietf-lamps-x509-slhdsa-04.txt

[Tomas Gustavsson <[e-mail]>]

I would think that millions of large organisations have some such designs, which have worked well and has never been considered bad design until now. Using partitioned CRLs having hundreds of thousands of CRLs with 200 entries on each I would not consider a better design. I would simply recommend to stay clear of SLH-DSA for those use cases. Arguing the classic principle of using the right tool for each job.

I do know of practical cases where operational learnings from using one huge CRL have influenced the choice to move to partitioned CRLs, but it would still not fit into the envelope of SLH-DSA. Then OCSP remains, and I also know of use cases that only use OCSP to not have to issue CRLs, but I don’t think I would recommend SLH-DSA either for large scale, high speed, OCSP.


________________________________
From: Michael Richardson <[e-mail]>
Sent: Saturday, March 29, 2025 1:10:48 PM
To: Sun Shuzhou <sunshuzhou=[e-mail]>
Cc: [e-mail] <[e-mail]>
Subject: [lamps] Re: I-D Action: draft-ietf-lamps-x509-slhdsa-04.txt


Sun Shuzhou <sunshuzhou=[e-mail]> wrote:
    > We build and run a private PKI internally. In many scenarios, a large
    > CRL is used, it is indeed painful, but it is the only solution (due to
    > historical poor design or other limitations/considerations).

I'm curious about if there are any recorded lessons learned about the poor
design.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-                      *I*LIKE*TRAINS*