A Novel Optimized Encoding Approach for Certificate Revocation

One of the goals of a PKI (Public Key Infrastructure), which is ubiquitous in our systems and networks, is to be able to create a trusted association — represented by a certificate — between a public key and an entity; It is however, of the same importance, to be able to revoke this trust. A major challenge is to efficiently share the revocations that took place. Two existing and widely used methods are presented: certificate revocation lists (CRLs) and the Online Certificate Status Protocol (OCSP). Both mechanisms can be optimized but have limitations, especially due to their cumbersome nature. In this article, a new encoding scheme (LightyCoding) is proposed, which is no longer based on the historical ASN.1 standard, and which offers a lightweight structure and improved performance. We describe its structure and functioning before proceeding with tests. The results are a significant reduction in CRL size of around 50% for most uses and 30% for OCSP, but still containing the same useful data as an ASN.1-encoded revocation. We also describe techniques implemented in our encoding to ensure frontand backward-compatibility, facilitating integration and use.