Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

TU 2 PKI > Revocation > Flashcards

Revocation Flashcards

1
Q

Certificate Revocation

A
  • Abortive ending of the binding between subject and key (public key certificate) OR subject and attributes (attribute certificate)
  • Is initiated by the subject OR the issuer
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Revocation requirements

A
  • Revocation information is publicly available
  • Authenticity can be checked by everyone
  • Revoked certificate is unambiguously identified
  • Information about the time of the revocation
  • Optional:
    -> Revocation reason
    -> Temporary revocation
    -> X.509: CAs are responsible for publishing revocation information
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Revocation mechanisms

A
  • Dedicated infrastructure for dissemination of authentic revocation information
  • Certificate Revocation List (CRLs)
  • Online Certificate Status Protocol (OCSP)
  • Certificate Revocation System (CRS)
  • Certificate Revocation Trees (CRT)
  • Revocation in PGP
  • Alternative: Very short certificate validity period -> no revocation needed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Structure of a CRL

A
  • Version
  • Signature ID
  • Issuer
  • This Update
  • Next Update
  • List of revoked certificates (sequence of CRL entries)
  • CRL-extensions
  • Signature
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Structure of a CRL entry

A
  • userCertificate
  • revocationDate
  • CRLEntry-extensions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

CRL Extensions

A
  • can affect the CRL as a whole OR
  • each single CRL entry (all of them)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CRL extensions: AKI/IAN

A
  • Authority Key Identifier
  • Issuer Alternative Name
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

CRL extensions: CRL Number

A
  • Monotonically increasing sequence number
  • Non-critical extension, must be included in all CRLs
  • To determine when a particular CRL supersedes another CRL
  • Two CRLs for same scope generated at different times must not have same CRL number
  • Supports the use of Delta CRLs
    -> Complete and Delta CRLs for a given scope must share one numbering sequence
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

CRL extensions: Issuing Distribution Point

A
  • Critical extension
  • Identifies the CRL distribution point and scope
  • Indicates whether the CRL covers revocation for:
    -> end-entity certificates only,
    -> CA certificates only,
    -> Attribute certificates only,
    -> a limited set of reason codes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

CRL entry extensions

A
  • Affect the current CRL entry AND MAYBE
  • Some following ones (but not necessarily all of them)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CRL entry extensions: Reason Code

A
  • Non-critical extension
  • Identifies the reason for certificate revocation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

CRL entry extension: Hold Instruction Code

A
  • Non-critical extension
  • Indicates the action to be taken after encouraging a certificate that has been places on hold
  • Standard actions: None, contact issuer or reject certificate, reject certificate
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

CRL entry extension: Invalidity Date

A
  • Non-critical extension
  • Provides the (suspected) date on which the certificate became invalid
  • CRL issuers are strongly encouraged to share this data with CRL users
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Publishing CRLs

A
  • Most common: Web pages, LDAP
  • File transfer protocol
  • CRL push services (broadcasts)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

CRL push service

A
  • CRLs are delivered to registered clients
  • Searching for a CRL is unnecessary
  • Can only be used online
  • Suitable for e.g. computer in Intranet, Servers
  • Covers only certificates of few PKIs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Locating a CRL

A
  • Using the policy: the policy of the issuer names places where its CRLs are published
  • Using the certificate: CRLDistributionPoints extension
17
Q

Locating a CRL: CRLDistributionPoints extension

A
  • X.509 Certificate extension
  • Non-critical
  • Identifies how CRL information is obtained -> Pointer to the places where the CRL will be located (usually as a URL)
  • Usage recommended
  • Realized by the most typical applications
18
Q

CRL properties

A
  • Can be used offline (CRL caching)
  • Easy implementation & management
  • High information content (extendable!)
  • The CRL (full CRL) contains information about all revoked certificates (size increases monotonically)
  • All information is transferred at the same time
    -> High load (peak) at “next update” time
    -> Long validity period -> bad timeliness
    -> Short validity period -> bad performance
19
Q

Over-Issued CRLS

A
  • CRLs issued more frequently than “nextUpdate” requires
  • e.g., on a regular basis or with every certificate revocation
  • frequency of the update is chosen by the client
    -> improved timeliness
    -> better load distribution
20
Q

Delta CRL

A
  • Format like a “normal” CRL + Delta CRL Indicator extension
  • Contains all changes since Base CRL was issued
  • Associated to Base CRL by the BaseCRLNumber
    -> Better network load, better scalability
    -> Slightly increases administration costs (client and server)
  • Can be combined with Over-Issued CRLs:
    -> Together with each Full CRL also Deltas to the still valid CRLs are issued
21
Q

X.509 CRL extensions: Delta CRL Indicator

A
  • Critical extension
  • Identifies a CRL as being a Delta CRL
  • Contains a single value called BaseCRLNumber
  • The BaseCRLNumber identifies the CRL used as the starting point in the generation of this Delta CRL
  • The referenced base CRL must be published as a complete CRL
22
Q

X.509 CRL extensions: Freshest CRL

A
  • (aka Delta CRL Distribution Point)
  • Non-critical extension
  • Identifies how to obtain Delta CRLs
  • Must not appear in Delta CRLs
23
Q

Indirect CRLs

A
  • Issuer of the CRL is not the issuer of the certificates
  • Revocation can be delegated
  • Revocation instance can operate online even if certificate issuer is offline
  • Reflects the different security requirements on the keys that are used for signing certificates and the ones that are used for signing CRLs
24
Q

X.509 CRL entry extension: Certificate Issuer

A
  • Critical extension
  • Identifies the certificate issuer associated with an entry in an indirect CRL
  • If this extension is not present:
    -> on the first entry in an indirect CRL: the certificate issuer defaults to the CRL issuer
    -> on subsequent entries: the certificate issuer for these entries is the same as that for the preceding entry
25
Q

CRL segmentation

A
  • Revocation information for disjoint sets of certificates is split up into multiple Partitioned CRLs
  • Relevant CRL identified:
    -> Directly: Multiple CRLDistributionPoints, or
    -> Indirectly: CRLDistributionPoints extension points to a special Redirect CRL
  • Redirect CRL
    -> Set of pairs (CRLDistributionPoint, Scope)
    -> The scope describes a set of certificates
    -> Advantage: Can be changed later
26
Q

Vor-/Nachteile: Full-CRL

A
  • Vorteile:
    -> Informationsgehalt hoch
    -> Management einfach
    -> Implementierung einfach
  • Nachteile:
    -> Schlechte Skalierbarkeit
    -> Hohe Last zum Zeitpunkt nextUpdate
    -> Langer Gültigkeitszeitraum: schlechte timeliness vs. kurzer Gültigkeitszeitraum: schlechte Performance
27
Q

Vor-/Nachteile: Over Issued

A
  • Vorteile:
    -> Verbesserte Timeliness
    -> Updateverhalten vom Client wählbar
    -> Verbesserte Lastverteilung
  • Nachteile:
    -> erhöhte Last wenn Clients alle CRLs herunterladen
    -> Häufiges Erstellen der CRLs
28
Q

Vor-/Nachteile: Partitioned-CRL

A
  • Vorteile:
    -> Partitionierung nach Typ, Seriennummernbereich oder Namensbereich gültig
    -> Beschleunigung der Prüfung durch kürzere CRLs
  • Nachteile:
    -> Segmentierung zu späterem Zeitpunk nicht änderbar
29
Q

Vor-/Nachteile: Redirect-CRL

A
  • Vorteile:
    -> Segmentierung nachträglich änderbar
    -> Sperrinformationen werden auf mehrere CRLs aufgeteilt (Segmentation)
  • Nachteile:
    -> Erhöhter Verwaltungsaufwand
    -> Komplexe Implementierung
30
Q

Vor-/Nachteile: Indirect-CRL

A
  • Vorteile:
    -> Zertifikatssperrung kann delegiert werden
    -> Sperrinstanz kann unabhängig vom Aussteller der Zertifikate (online) agieren
    -> Vereinfacht und beschleunigt CRL-Verwaltung beim Benutzer
  • Nachteil: Schlechte Skalierbarkeit

TU 2 PKI (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions