Problem - Kevin Tafuro

Certificate revocation
What happens if an attacker steals an entity’s private key? When that happens, the
attacker can decrypt anything intended for the entity. The attacker can also forge
digital signatures as if they came from that entity. In short, the attacker can masquerade
as the rightful owner of the certificate.
Once a certificate has been issued, it is normally put into production, where it will
generally be distributed to many clients. If an attacker compromises the associated
private key, the attacker now has the ability to use the certificate even though it
doesn’t belong to the attacker. Assuming that the proper owner is aware of the compromise,
a new certificate with a new key pair should be obtained and put into use.
Now there will be two certificates out there for the same entity, and both are technically
valid because they both contain a valid CA signature. However, one of them
clearly should not be trusted. The compromised certificate will eventually expire, but
in the meantime, how will the world at large know not to trust it?
The answer lies in something called a certificate revocation list (CRL). A CRL(shown
in Figure 10-3) contains a list of all of the revoked certificates a CA has issued that
have yet to expire. When a certificate is revoked, the CA is declaring that the certificate
should not be trusted.
Request CRLs
Certification
Authority
Send CRLs
Client Server
Figure 10-3. Clients should retrieve CRLs from the CA that issued a certificate
Bandwidth is a significant concern when distributing CRLs, because clients need to
have reasonably current revocation information to properly validate a certificate. In
an ideal world, the client would get up-to-date revocation information as soon as the
CA gets the information. Unfortunately, many CAs distribute CRLs only as a huge
list. Downloading a huge list before validating each certificate could easily add unacceptable
latency and would place undue load on the server when there are many clients.
As a result, CAs tend to update their CRLs regularly, but not immediately after
Understanding Public Key Infrastructure (PKI) | 507
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.