Partition based hash tree — An efficient certificate revocation system
Raasi Manasa Annavajjala, Vijay Anand · 2017
A critical check in the certificate validation process is to determine whether a certificate has been revoked or not. Revocation of a certificate is the objective of invalidation of a certificate before its operational lifetime, which was set during its creation. Traditional certificate revocation systems include Certificate Revocation List (CRL) which requires all users to download the list of revoked certificates and store it locally that is subsequently used, to check the revocation status of the certificate prior to usage of the certificate. Another more modern approach is Online Certificate Status Protocol (OCSP) that allows for an online check of a certificate status from a well-known server before a certificate is processed. Searching for the revocation status of a certificate is commonly done with a Merkle hash tree algorithm, in which revoked certificates are arranged in the form of binary tree and binary searching algorithm is used to search for the target certificate. Existing approaches based on the Merkle Hash tree have their own drawbacks and, in this paper, we propose a different type of search algorithm, the partition based hash tree, to improve searches for revoked certificates. We also identify how this proposed approach improves efficiency and scalability issues over traditional approaches of certificate search.