Nonmonotonicity, User Interfaces, and Risk Assessment in Certificate Revocation

We consider certificate revocation from three high-level perspectives: temporal nonmonotonicity, user interfaces, and risk management. We argue that flawed understanding of these three aspects of revocation schemes has caused these schemes to be unnecessarily costly, complex, and confusing. We also comment briefly on some previous works, including those of Rivest [16], Fox and LaMacchia [5], and McDaniel and

[1]  Michael Myers.  Revocation: Options and Challenges , 1998, Financial Cryptography.

[2]  Stephen Farrell,et al.  Internet X.509 Public Key Infrastructure Certificate Management Protocols , 1999, RFC.

[3]  Paul C. Kocher.  On Certificate Revocation and Validation , 1998, Financial Cryptography.

[4]  Carlisle Adams,et al.  A General, Flexible Approach to Certificate Revocation , 1998 .

[5]  Rebecca N. Wright,et al.  An authentication logic supporting synchronization, revocation, and recency , 1996, CCS '96.

[6]  Stuart G. Stubblebine,et al.  Recent-secure authentication: enforcing revocation in distributed systems , 1995, Proceedings 1995 IEEE Symposium on Security and Privacy.

[7]  Patrick D. McDaniel,et al.  Windowed certificate revocation , 2000, Proceedings IEEE INFOCOM 2000. Conference on Computer Communications. Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies (Cat. No.00CH37064).

[8]  David A. Cooper.  A Closer Look at Revocation and Key Compromise in Public Key Infrastructures , 1998 .

[9]  Carl A. Gunter,et al.  Generalized certificate revocation , 2000, POPL '00.

[10]  Patrick D. McDaniel,et al.  A Response to ''Can We Eliminate Certificate Revocation Lists?'' , 2000, Financial Cryptography.

[11]  David A. Cooper.  A more efficient use of delta-CRLs , 2000, Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000.

[12]  Russ Housley,et al.  Internet X.509 Public Key Infrastructure Certificate and CRL Profile , 1999, RFC.

[13]  Carlisle M. Adams,et al.  X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP , 1999, RFC.

[14]  Jonathan K. Millen,et al.  Efficient fault-tolerant certificate revocation , 2000, CCS.

[15]  Barbara Fox,et al.  Certificate Recocation: Mechanics and Meaning , 1998, Financial Cryptography.

[16]  Moni Naor,et al.  Certificate revocation and certificate update , 1998, IEEE Journal on Selected Areas in Communications.

[17]  Ronald L. Rivest,et al.  Can We Eliminate Certificate Revocations Lists? , 1998, Financial Cryptography.