[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: 3280bis: CRL validation
Title: Message
Denis
Pinkas.
You
wrote:
"Note
that I am personally against Santosh's proposal which is over-complex."
Let us look at what
is "over-complex" about it. I would use two standard metrics for
complexity: software and computational. I would add two personally defined
complexity metrics: intellectual and analytical.
I define
intellectual complexity as the ability to understand the algorithm. In
this area, the semiformal approach I used may have confused some. But, all
the algorithm is saying is that after ignoring self-issued certificates, both
paths should match in terms of issuer and subject. To me that seems
simple.
I define analytical
complexity as the ability to analyze the security property. Again, in this
area, all the algorithm is ensuring is that at each level the same subject is
referred to ensuring that even if names are not unique globally, the correct CRL
is obtained.
As you know software
complexity is defined in the software engineering literature as the ability to
comprehend and maintain the implementation. It is measured using metrics
such as cyclometric and there are tools that can be run against the code to
capture this. While I have not implemented the algorithm and can not say
what the actual number is, I suspect it will be low.
As you know
computational complexity is defined as the computation power used to execute the
algorithm. I suspect if employed during path validation only, it is simply
name matching in linear space. So, it will not have any exponential
problem (so called NP problems); it will be linear and matching two names is not
an expensive proposition. Now, if the algorithm is used to guide path
development, you will see actually improvement in performance by eliminating
paths that are not relevant or should not be used.
In summary, my
analysis shows it is not "over-complex". It would help if you proposed an
alternative that is secure and less complex. Feel free to provide
definitions and metrics for complexity.
Santosh Chokhani
Orion Security Solutions,
Inc. 1489 Chain
Bridge Road, Suite 300 McLean, Virginia 22101 (703) 917-0060 Ext. 35 (voice) (703) 917-0260 (Fax) chokhani@xxxxxxxxxxxx Visit our Web site http://www.orionsec.com