Push distribution of revocation list

A Certificate Revocation List (CRL) lists revoked, non-expired certificates. For non-partitioned CRLs, the same CRL is used to validate every certificate issued by the same CA. The na¨ıve approach to CRL distribution is to let every validating client fetch its own copy (pull operation) from a central distribution point. This is an obviously inefficient method since the infrastructure between the CRL issuer and the clients must transfer multiple copies of the same information. A push based distribution scheme may avoid this problem with a messaging middleware system.

A push based scheme requires a service point in (or near) the client where CRL data can be delivered asynchronously with regard to the client main activity. Candidate technologies varies with network topology; an SMTP/Sendmail based system is appropriate for a WAN, so is a dedicated MOM (Message Oriented Middleware) system. For a LAN, a UDP-based multicast scheme would exploit the inherent broadcast nature of a shared media, although some robustness should be added to offer reliable delivery.

The client side service point for reception of push based transmissions may reside behind a firewall or NAT (Network Address Translation) device, which would require configuration of these devices for the inbound connections to succeed. Alternatively, the service point could be placed in the DMZ-branch (DeMilitarized Zone) of the local network, together with web- and mail servers.

COTS client programs, which need the CRLs in order to validate certificates, do not recognize a push based arrangement. They all require a URL through which they can fetch the CRL when needed.

As a matter of fact, the pull based distribution scheme is inherent in the CRL syntax definitions.

The association between a CRL and a certificate is given in a certificate extension (CRLdp) as a service point URL, so a holder of a certificate will know from where to pull the CRL on which this certificate may be listed. There is no opposite link, i.e. no information in the CRL regarding the

MOM

Figure 5.1 Arrangement of an HTTP proxy to bridge pull and push based distribution. The upper part shows clients pulling CRLs directly from a CRL distribution point, whereas the lower part shows an arrangement using a MOM middleware and a HTTP proxy so that the client can pull and the server can push.

range of certificates it is representing. In a push based distribution, this association (represented by the service point URL) must be maintained.

A proxy program in (or near) the client can connect the two distribution schemes. The proxy has two service points: One that offers CRL pull through e.g. an HTTP protocol, and another that accepts CRL push through e.g. the SMTP/MIME protocols. CRLs received through the push protocols are stored according to their validity period and service point URL and offered to clients through the pull service port. This arrangement is shown in Figure 5.1.

For this arrangement to work, the clients’ pull requests for CRLs must be directed to the proxy’s service point, and not to the CA. This can be accomplished in at least three ways:

1. The value of the CRLdp certificate extension must contain the URL of the service point of the proxy

2. The proxy configuration of the client must be set to the service point of the proxy

3. The HTTP proxy must be integrated in the firewall, inspect all HTTP transactions and inter-cept those which are addressed to the CA’s CRL distribution point

The two latter options in the list require that the HTTP proxy also acts as a “normal” web proxy.

5.1.1 Traffic volume considerations

In the client’s end, the two different distribution alternatives shown in Figure 5.1 does not make any difference in terms of traffic volume. The client sends requests for a CRL when needed and gets a CRL in return.

In the server end, however, the arrangement makes a big difference since the CA transmits onlyone copyof the CRL to the MOM distribution architecture each time a new CRL is issued. In the basic arrangement (upper part of the Figure 5.1), the CA transmits one CRL copy for every client request.

The number of requests for CRLs per issue scales with the number of client and the number of applications, since application which need certificates and CRLs tend to store them separately.

Clients are assumed to fetch CRLs when needed, which is at the first validation operation after the old CRL has expired. A high density of requests are therefore expected shortly after the expiration of a CRL since all clients will need new CRLs at approximately the same time. A proxy as outlined in Figure 5.1 will reduce the size of the traffic peak as well as reduce the total traffic volume.

5.1.2 Traffic calculations

The numbers used in subsequent calculations are taken from Table 2.1 and Table 4.1 in addition to the values listed below.

Size of CRL(s_B) 103 kB Number of relying parties 400

Validation rate(λtot) 400 per day = 0.0046 per second 5.1.2.1 Pull distribution, no proxy

The peak server traffic following a new CRL issue (pull distribution, no proxy arrangement) has been analyzed by Cooper [5] and found to be

R(t) =N ve^−vt (5.1)

whereR(t)denotes the server-side CRL fetch rate at time instancetrelative to the new CRL issue instance. N denotes the number of relying parties, which in practice means the number of running clients multiplied with a number of client applications with separate CRL stores. v denotes the client validating rate, which is denotedλtotelsewhere in this section.

The plot of server side traffic rates resulting from the clients’ request for new CRLs is shown in Figure 5.2. The total volume for the CRL issue (every 4 hours) distribution is 103 kB * 400 = 41.2 MB, leading to an average data rate of2.86 kB per second.

On the client side, a CRL (103 kB) has to be fetched by the client every 4 hours, which results in an average rate of7.15 bytes per second.

0 20 40 60 80 100 120 140 160 180 200

0 200 400 600 800 1000 1200

Server side traffic rate (kBytes/second)

Time after new CRL issue (seconds)

Figure 5.2 Server side traffic rates due to pull operations of new CRLs

5.1.2.2 Push distribution with MOM and a proxy

When push distribution is employed, the ideal arrangement would allow the middleware to send only one copy of the CRL over a network link. Since the transmission is scheduled by the CA server, there exists no traffic peak as shown in Figure 5.2. The total server side traffic is limited to one CRL copy (103 kB) every 4 hours, leading to an average data rate of7.15 Bytes per second.

The client traffic traffic rate is the same number.

5.1.2.3 Parameter sensitivity

The advantage of push based distribution (in terms of traffic volume reduction) grows with the number of relying parties (which is 400 in this example).

The traffic rates are also sensitive to the issuing intervals of CRLs. A reduction of issuing interval by a half will double the traffic rates.