Re: Current status of CRL validation ?

[Ed Gerck <egerck@xxxxxxx>]

Eric Norman wrote:
> 
> On Tue, 30 Mar 2004, Ed Gerck wrote:
> 
> > Moreover, PKIX/X.509 revocation is a "will" to revoke but not an actual
> > revocation. Few recognize, as you have now hit, that cert revocation
> > in PKIX/X.509 is a solution to a non-existent problem ... while the real
> > problem is left utterly unsolved.
> 
> As far as this reader knows, the real problem is also unstated.  Might I
> be reminded about just what the "real problem" is?

The real problem is to make the cert unusable when revoked. For that,
one should also not need to rely on any third-party or users. In particular, 
I believe that trusting user intervention (even to update software) is a 
very weak assumption.

It's apparent in this thread that revoking by reference (the current
method with CRLs and OCSPs) has some unsolved and unsolvable problems.
To consider them a "feature" is the first stage of problem solving.
My comments on this, practically the same since '97, is that we should 
move to the second stage.

Cheers,
Ed Gerck