Let's Revoke: Scalable Global Certificate Revocation
Let's Revoke: Scalable Global Certificate Revocation
复制标题
DOI：
10.14722/ndss.2020.24084
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Trevor Smith;Luke Dickenson;K. Seamons
中科院分区：
文献类型：
--
作者：
Trevor Smith;Luke Dickenson;K. Seamons
当前的撤销策略存在许多问题，阻碍了它们的广泛采用和使用，包括可扩展性，隐私和新的基础设施要求。因此，撤销通常被忽略，使客户端容易受到中间人攻击。本文提出了让我们撤销，一个可扩展的全球撤销策略，解决了目前的撤销检查的关注。Let's Revoke为每个证书引入了一个新的唯一标识符，作为包含撤销状态信息的动态大小位向量的索引。位向量方法可以为客户端和证书颁发机构提供更有效的撤销检查。我们将Let's Revoke与现有的撤销方案进行了比较，并表明它需要的存储和网络带宽比其他系统更少，包括那些只覆盖全球证书空间的一小部分的系统。我们通过模拟进一步证明，即使在大规模撤销事件中，Let's Revoke也可以线性扩展到100亿个证书。
—Current revocation strategies have numerous issues that prevent their widespread adoption and use, including scalability, privacy, and new infrastructure requirements. Consequently, revocation is often ignored, leaving clients vulnerable to man-in-the-middle attacks. This paper presents Let’s Revoke, a scalable global revocation strategy that addresses the concerns of current revocation checking. Let’s Revoke introduces a new unique identifier to each certificate that serves as an index to a dynamically-sized bit vector containing revocation status information. The bit vector approach enables significantly more efficient revocation checking for both clients and certificate authorities. We compare Let’s Revoke to existing revocation schemes and show that it requires less storage and network bandwidth than other systems, including those that cover only a fraction of the global certificate space. We further demonstrate through simulations that Let’s Revoke scales linearly up to ten billion certificates, even during mass revocation events.