|
From: Anders R. <and...@gm...> - 2016-08-23 05:00:50
|
Assume there is a network of trusted providers like banks. Assume you want to save transactions including revocation data. There are (AFAIK) see four solutions: 1. CRLs 2. OCSP read by the RP 3. Stapled OCSP provided by the sender 4. Short-lived certificates 1 and 2 looks very unattractive compared to 3. OTOH, short-lived certificates eliminates specific revocation data altogether. There is a snag with 4; it puts more trust into the CA. I'm thinking about daily certificates but with a life-span of a week or so. WDYT? Anders |