On Jun 3, 2005, at 01:30, Mike Helm wrote:
I think it is hard to make one rite answer & don't have a strong
opinion on this,
but why _wouldn't_ the static info (local CRL) be the usual first
test? Isn't it
always the cheapest test? Since it should _never_ be better than the
the OCSP check, checking it last seems useless unless (and only unless)
all the OCSP responses are timeouts or unknown. So just do it first
and then forget it (see above).
I'm not sure the gain outweighs the additional complexity. How many
percent of the issued certificates are typically revoked? That's the
maximum reduction of OCSP queries that you would get as a result.
Plus, you have to watch out when encoding the logic: if you process
the CRL first, the cert not being in the CRL should equal "unknown"
and you should continue looking at other places; if you process the
CRL last and the cert is not in the CRL, it should evaluate to "good".
For the proposed Proxy Revocation method using CertiVeR an "unknown"
status for the Proxy Certificate will always be obtained from a CRL (as
their revocation info is registered not in the CRL but into a Database
for such purpose), so from this point of view there is an overhead if
you first check with such CRL. Also if there are several CAs involved
then you should check every correspondent CRL as there is not a concept
like OCSP's Trusted Responder which serves several CAs. On top of that,
if a CRL has a considerable size then its search/download process may
become cumbersome.