Subject: RE: large crl's

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 19 Sep 2006 17:01:36 -0700

Message sizes should be measured in packets, not bytes. The TCP startup
overhead dominates here.

You couldhave partition size=1 cert but the group decided against that
approach. 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Dave Engberg
> Sent: Tuesday, September 19, 2006 5:50 PM
> To: Kemp David P.; Christine Karman; [email-masked]
> Subject: RE: large crl's
> 
> 
> This is comparing a theoretical against an actual.
> 
> If the US DoD were using the CA that supports automated CRL 
> partitioning, then each CRL would represent the status of 750 
> certs.  With the DoD's 20% rate of revocation, the average 
> CRL partition would have 150 entries, or around 3.7kB.  This 
> is twice as large as the actual OCSP responses returned by 
> the DoD today, and the upper bound on a CRL partition size is 
> significantly larger.
> 
> It's important to note that any CRL partitioning is fixed for 
> the entire lifetime of the certs ... you can't change your 
> tuning later to improve bandwidth to the client or 
> (inversely) the aggregate size and number of segments to 
> replicate.  An OCSP deployment can be tuned independently 
> long after cert issuance based on the operational usage 
> characteristics.
> 
> 
> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Kemp David P.
> Sent: Tuesday, September 19, 2006 10:22 AM
> To: Christine Karman; [email-masked]
> Subject: RE: large crl's
> 
> ...
> 
> One difference is size.  For any given number of 
> certificates, an OCSP response is significantly *larger* than 
> a CRL!  An OCSP message is about 350 bytes body + 
> 79/unrevoked cert + 101/revoked cert.  A CRL, in contrast, is 
> about 200 bytes body + 0/unrevoked cert + 30/revoked cert.
> (both modulo assumptions on DN size, serial number size, 
> signature size, use of extensions, etc).  
> 
> ...
> 
> If a 1% revocation rate doesn't reflect your subscriber base, 
> then assume 40% of certificates are revoked, yielding the 
> following CRL and OCSP sizes:
> 
> Certs/   40% revoked
> query    CRL    OCSP
>    1     212     438
>    2     224     526
>    5     260     789
>   10     320   1,228
>   20     440   2,106
>   50     800   4,740
>  100   1,400   9,130
>  200   2,600  17,910
>  500   6,200  44,250
> 1000  12,200  88,150
> 
> What does this mean, since nobody does an OCSP query on 1000 
> certs?  It means that if you set some threshold on the 
> acceptable size for a certificate status message, a CRL can 
> represent the status of many more certificates than an OCSP 
> response.  If 500 bytes is your limit, that would be an OCSP 
> response for 2 certs, or a partitioned CRL covering 20 certs. 
>  If 2K bytes is your limit, that would accommodate an OCSP 
> response for 20 certs, or a CRL covering a 150-cert partition.
> 
> Another way of looking at it would be to assume that a 
> company needs to store revocation status for email messages 
> of its 10,000 employees.  If it stored 10 partitioned CRLs, 
> that would require 122 KB.  If instead it stored 10,000 OCSP 
> responses, that would require 4,380 KB for the same set of employees.
> 
> The point of the above is that it is incorrect to assume that 
> "online verification" means only "OCSP", and even more 
> incorrect to assume that because one organization has done a 
> horrible job of engineering its CRLs, the fault lies with the 
> CRLs themselves.
> 
>