A Practical and Efficient Tree-List Structure for Public-Key Certificate Validation

Abstract

In this paper, we present the Tree-List Certificate Validation (TLCV) scheme, which uses a novel tree-list structure to provide efficient certificate validation. Under this scheme, users in a public-key infrastructure (PKI) are partitioned into clusters and a separate blacklist of revoked certificates is maintained for each cluster. The validation proof for each cluster's blacklist comes in the form of a hash path and a digital signature, similar to that used in a Certificate Revocation Tree (CRT) [1]. A simple algorithm to derive an optimal number of clusters that minimizes the TLCV response size was described. The benefits and shortcomings of TLCV were examined. Simulations were carried out to compare TLCV against a few other schemes and the performance metrics that were examined include computational overhead, network bandwidth, overall user delay and storage overhead. In general, we find that TLCV performs relatively well against the other schemes in most aspects.

FcgiOCSP: a scalable OCSP‐based certificate validation system exploiting the FastCGI interface

“…Thus, it becomes of crucial importance that the mechanism used for certificate revocation and validation must provide timely information to users and must be scalable for deployment [6]. Several OCSP implementations are already available (both as open source as well as as commercial products) nowadays, and even though some commercial products achieved important milestones in terms of certificate validations per second [7], we will show in our work that others do not achieve the scalability requirement.…”

Uma ICP baseada em certificados digitais autoassinados

“…O problema é minimizado, mas não eliminado. Outra alternativa é a validac ¸ão de Certificados em Árvore-Lista (Tree-List Certificate Validation -TLCV) [Lim et al 2008] que usa uma estrutura do tipo árvore-lista para promover um ganho de performance sobre a proposta de Kocher.…”