Hot answers tagged

4 votes

How are CRL implemented?

Each CA has their own revocation list. When your device validates a certificate, it determines what CA was used to sign it, downloads the CRL (whose URL is included in the CA certificate) and checks ...
user avatar
  • 6,129
3 votes
Accepted

Secure Design and CRL?

OK, let's go over them: Fail-Safe Defaults: this is the most important one, as a CRL doesn't provide on-line information and may not be available or out-of-date; Economy of Mechanism: a CRL may ...
user avatar
  • 85.9k
3 votes
Accepted

Any case that can require to encrypt a certificate revocation list before distribution

No. A CRL is as public as the certificate it revokes; it has to be signed to guarantee authenticity, but not encrypted. There are no optional confidentiality requirements for CRL distribution in RFC ...
user avatar
3 votes
Accepted

How are certificate status obtained on browsers?

OCSP is not susceptible per se to MITM attacks, but it does have other problems: Most browsers used to soft-fail, e.g., if they couldn't get the OCSP response for some reason, it allowed the ...
user avatar
  • 6,129
2 votes

What does (06) in "CRL Signing (06)" mean?

The Key Usage field is represented as a bit string, where each bit represents one of the options, so that multiple options can be set. The value 6 it's just the ...
user avatar
  • 6,129
2 votes
Accepted

How are CRL implemented?

The end entities (phones, PCs, etc.) doesn't store the CRL files. I mean doesn't store permanently. :) In the Certificate there's a field called CRL Distribution Points where the CRL file could be ...
user avatar
  • 36
2 votes

CRL number generation sequence: can I use a time stamp?

Using a time stamp is certainly allowed, provided it is truly monotonically increasing. What I want to point out here is that computers have knowledge of the current date and time through their ...
user avatar
2 votes
Accepted

how to avoid attack on Certificate Revocation List by the owner of the private key?

Yes one could do this, the repudiation wouldn't be very convincing. The CRL really isn't very relevant. A person can always claim his private key was stolen. His credit card was stolen or his car was ...
user avatar
  • 10.6k
2 votes

How to sign a CRL file if I have offline keys?

At some point your Root CA has to have control over it's subordinate CAs. If there was a scheme where it delegates this control to another server (such as your OCSP-like suggestion), the Root CA ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible