Re: [lamps] The Status of OCSP and its future

["Dr. Pala" <[e-mail]>]

Hi Michael,

On 10/24/19 1:10 PM, Michael Richardson wrote:
> Dr. Pala <[e-mail]> wrote:
>      > Specifically, for very large PKIs (i.e., few hundreds million
> [...]
>      > providing a good revocation infrastructure is.
>
> Why not just spread your load across multiple OCSP endpoints by putting
> different AuthorityInfoAccess values in?

thanks for the comment - yes, I think that is an option. However, that 
does add complexity to the issuing system that might need to be tweaked 
as the infrastructure grows... and that does not lower my operational 
costs that can be significant for large PKI environments.

The proposal here is to optimize for the average case (and maybe 
simplify the messages in the process) - in particular providing 
responses for ranges of certificates (serial) where there is no 
revocation information available.

Although this is quite relevant for the Industry I work in (Cable), 
optimizing revocation information distribution might lower the 
operational cost for every PKI that implements revocation - the WebPKI 
included. In particular, if such a solution existed, then we could see 
OCSP responses for the WebPKI that have shorter validity periods, I 
think and hope: hours instead of days or months.

Thanks again for the feedback!

Cheers,
Max

-- 
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
OpenCA Logo