On the Release of Crls in Public Key Infrastructure

Abstract

Public key infrastructure provides a promising founda-tion for verifying the authenticity of communicating par-ties and transferring trust over the internet. The key issue in public key infrastructure is how to process certificate revocations. Previous research in this aspect has con-centrated on the tradeoffs that can be made among dif-ferent revocation options. No rigorous efforts have been made to understand the probability distribution of certifi-cate revocation requests based on real empirical data. In this study, we first collect real empirical data from VeriSign and derive the probability function for certifi-cate revocation requests. We then prove that a revocation system will become stable after a period of time. Based on these, we show that different certificate authorities should take different strategies for releasing certificate revocation lists for different types of certificate services. We also provide the exact steps by which certificate au-thorities can derive optimal releasing strategies.