Quantifying the effects of more timely certificate revocation on lightweight mobile devices

Abstract

Public Key Infrastructure (PKI) is a key infrastructure for secure communications and transactions on the Internet. We revisit the problem of timely certificate revocation and develop a performance analysis framework with more realistic assumptions of when certificates are revoked, a query model differentiating revoked and unrevoked certificates, and realistic cost factors. Our analysis is fine-grained and shows the impact of a revocation scheme on the computation, storage and bandwidth costs particularly on mobile devices as the verifiers. We apply our performance framework to analyze the following schemes: CRL, OCSP, CRS and CREV. Our analysis shows clearly the strengths and weaknesses of each scheme particularly for mobile lightweight verifiers under higher timeliness guarantees. © 2011 IEEE.