Hacker News Reader

Comment by OrvalWintermute | Hacker News Reader

Merkle Hash Trees are the well-known solution for this, whenever they decide to update the protocols (was software patent encumbered til 2017)

View on HN

Merkle Hash Trees are not a solution for offline checks. You can very easily check membership in a tree if someone sends you a proof of membership. But to get a proof, you'd either have to generate it yourself (meaning you're storing the whole set anyway) or get it from a third party (ie an online lookup, which is what OCSP is). The forefront of CRL design is in set compression techniques like Ribbon filters https://arxiv.org/pdf/2103.02515.pdf

I never said MHT are a solution for offline checks. That is a completely different problem space.

In the space domain, satellite ground systems have used a combination of guards, one way transmission, and others, although I am in favor of system-specific certificate whitelisting via running OCSP with local VAs, backed up by smart clients, with CRLs on the filesystem and in network shares.

CRL processing can cause timeouts, which is why it is always less preferred than the much more lightweight OCSP by comparison.

Furthermore, CRLs are blacklists, and newer OCSP is not exclusively, and, OCSP permits more flexibility with the various trust models that exist for it.

It sounds close to what the article suggests Let's Encrypt is using internally to store/generate the CRL files, though the article doesn't get into a lot of technical details to tell exactly if that is the case.

No. That isn't the same.

CRLs and OCSP are about individual certificates.

The beauty of Merkle Hash Trees for validation is it permits Statements e.g.

CAx = CA2 and 156 ≤ X < 343 (5)

The statement cj indicates that the certificate with serial number X = 156 issued by CA2 has been revoked, while the certificates with serial numbers from X = 157 to X = 343 (both included) issued by CA2 have not been revoked.

From https://www.researchgate.net/publication/220066804_Certifica...

Wouldn't a CRL that lists all the revoked certificates tell you that exact same information?

CRL's format is to list all the serial numbers in a blacklist, which means a CRL for a large well-used PKI is going to be gigantic by comparison to an MHT.

A CRL is not equivalent to modern OCSP, because modern OCSP can operate as a whitelist or a blacklist. However, CRLs are generally more secure than some of the OCSP variants because strong OCSP is used less (Nonced+authenticated/registered), and CRLs are not subject to replay attack like vanilla OCSP can be.

Reply on news.ycombinator.com