Optimal CRL Releasing Strategy in Public Key Infrastructure

Public key infrastructure has been proposed as a promising foundation for verifying the authenticity of communicating parties and transferring trust over the internet. One of the key issues in public key infrastructure is how to manage certificate revocations. Various technical solutions dealing with key revocation have been proposed. However, to the best of our best knowledge, no rigorous efforts have been made to understand the behavior of certificate revocation requests based on empirical data. Furthermore, there is no study on the managerial aspect of Certificate Revocation Release. In this study, based on the empirical data collected from VeriSign, we prove that a revocation system will become stable after a period of time. We show that different certificate authorities should take different strategies for releasing different types of certificate revocations. We also provide the exact steps by which certificate authorities can follow to derive optimal releasing strategies.