Re: [TLS] New directions in certificate status

On Wed, Oct 8, 2014 at 6:07 PM, Phillip Hallam-Baker
<phill@hallambaker.com> wrote:
> Please note:
>
> http://datatracker.ietf.org/doc/draft-hallambaker-compressedcrlset/
> Also note the pending IPR disclosure.
>
> In brief Rob Stradling and myself have come up with a radically new
> approach to certificate status that is vastly more efficient than any
> previous proposal that provides finer grain certificate status than
> the certificate validity interval.

Good idea. Unfortunately the draft is incomprehensible: key details
are missing. If understand this correctly, the idea is to use a
crit-bit tree to encode the certificate serial numbers, by removing
common prefixes. There are a lot of finicky details to specify, but
this should help.

What would be nice is some hard numbers on how much it helps.

>
> While compressing hash tables might appear to be a fools errand, it
> turns out that if the problem is correctly understood, CRLs actually
> compress astonishingly well. It is actually possible to represent the
> status of every one of the half million revoked certificates in the
> WebPKI using fewer bytes than the heavily edited Google CRLSet.
>
> There is still a powerful case for short lived certificates. But the
> minimum feasible expiry interval for short lived certs is 48 hours.
> Using a compressed CRL in combination with short lived certs would
> allow the vulnerability window to be reduced to minutes.
>
>
> We are of course aware that deployment will require a licensing regime
> that meets the need of all parties including competing CAs, open
> source software providers, etc. However lacking an existing licensing
> regime for the rights holder (if indeed any are granted), I thought it
> best to bring this to people's attention first.

Are you saying FRAND or something else?

>
> The nature of the invention is such that not applying for a patent
> would open the possibility that someone else might make a claim as has
> happened to me on numerous other occasions. In the past five years
> over $50 million has been spent on defending against such patent
> claims.
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin