Revocation

As explained in Real-World Cryptography

Certificate revocation is the process of declaring a previously issued certificate invalid before its scheduled expiration.

Certificate revocation lets a certificate authority declare an issued certificate invalid before its scheduled expiration, limiting the damage from a compromised certificate. section 9.3 section 9.6

Web systems have used three main approaches:

• Certificate Revocation Lists (CRLs) publish revoked certificates, but can become large and require frequent checking. section 9.3
• Online Certificate Status Protocol (OCSP) provides a web interface for checking whether a certificate is revoked, but depends on highly available CA services and can reveal traffic information. section 9.3
• OCSP stapling lets the website obtain a signed status response and attach it to the certificate during the TLS handshake. section 9.3

Figure 9.9 Certificate revocation on the web has had three popular solutions: Certificate Revocation Lists (CRLs), Online Certificate Status Protocol (OCSP), and OCSP stapling.

Compare the three revocation paths: published lists, direct status queries, and stapled status responses. section 9.3

How Real-World Cryptography covers it

How deep it goes

Compares CRLs, OCSP, and OCSP stapling, including operational drawbacks, but stops short of implementation details.

Examples

Uses web browsers, websites, mobile applications, CRLs, OCSP queries, and stapled responses as concrete examples.

What it assumes

Assumes familiarity with certificates, certificate authorities, browsers, and TLS handshakes.

What you can do after

Evaluate certificate-status mechanisms and recognize their availability, privacy, size, and user-experience tradeoffs.

How it connects

Connects certificate authorities, TLS handshakes, certificate pinning, certificate monitoring, CRLs, OCSP, and OCSP stapling.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Authorization in ActionCredential revocation is the invalidation of a credential before its expiration date.
• 

  liveBookmanning.com
  Software Security for DevelopersToken revocation is the invalidation of a security token before or at the end of its normal validity period.
• 

  liveBookmanning.com
  Spring Security in Action, Second EditionToken revocation is the process of invalidating a token before its normal expiration so that it can no longer be used.

Compare how 4 books explain revocation →

Related concepts

• token introspectionuses · Token introspection is an OAuth operation in which a service queries an authorization server about a token’s validity, status, and metadata.
• tokenuses · A token is a discrete unit of text, such as a word, word fragment, character, or symbol, represented and processed as an element by a language model.
• defense in depthpart of · Defense in depth is a security strategy that combines multiple protective controls so that the failure or compromise of one does not eliminate all protection.
• introspection uriuses · An introspection URI is a network address identifying an endpoint that validates a token or credential and returns its validity or associated metadata.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.