It's interesting to me that the largest PKI in the world does
not take
the approach of using large-transaction servers. We should go into
this with our eyes open because what we expect to be true in
some cases
may in fact be beside the point. Revocation schemes that scale up to
the numbers we are discussing typically don't attempt to
mirror the DNS
nor require large server farms - I'm speaking of the subset
difference
algorithm and others like it. In many ways, the PKI we're discussing
is more like the DTLA than an X.509 CA.
There are plenty of cute CRL alternatives. I came up with one myself, the
interval scoped CRL.
The problem is that with very few exceptions (e.g. scopes) the schemes are
patened up the wazoo. It is cheaper to buy racks of servers than to mess
with grasping patent holders who think that their scheme is worth
bazillions. There is also the problem that most of the cute schemes require
new clients and implementing things like revocation trees is much harder
than it appears.
Sadder still is the fact that the patent holders are right. There have been
several companies created for the purpose of exploiting revocation patent IP
claims. None has survived very long before being amalgamated but some went
IPO and there was certainly time for the patent holders to have cashed out
far more than it would be worthwhile for me to pay.
I have looked at the clever schemes and the brute force scheme. Turns out
brute force is cheaper and simpler and provides the data in real time.
What is the DTLA?