Certificate revocation system
View Patent ↗A method of managing certificates in a communication system having a certifying authority and a directory. Preferably, the method begins by having the certifying authority generate certificates by digitally signing a given piece of data. At a later point time, the certifying authority may produce a string that proves whether a particular certificate is currently valid without also proving the validity of at least some other certificates. The technique obviates use of certification revocation lists communicated between the certifying authority and the directory.
1. A method of conveying information about certificates, comprising:
at every date D of a sequence of dates, having an authority produce a digitally signed certificate revocation status using a single digital signature that provides a positive and explicit statement about the validity status at date D of each not-yet-expired certificate in a plurality of certificates;
providing the digitally signed certificate revocation status to a directory; and
having the directory store the latest received digitally signed certificate revocation status to be provided as a response to an inquiry about revocation status of a particular one of the plurality of certificates.
2. A method, according to claim 1 , wherein the certificate revocation status includes a revocation signature indicating certificates that have been revoked together with revocation dates thereof.
3. A method, according to claim 1 , wherein the directory is not trusted and can not make a valid certificate revoked and can not make a revoked certificate valid.
4. A method, according to claim 1 , wherein each of the plurality of certificates has a serial number.
5. A method, according to claim 1 , wherein digitally signing includes digitally signing with respect to a public verification key pk, which is digitally signed by the authority with respect to another public verification key PK.
6. A method, according to claim 5 , wherein having pk digitally signed by the authority includes having pk be a quantity within the plurality of certificates and having the authority digitally sign the certificates with respect to PK.
7. A method, according to claim 5 , wherein digitally signing with respect to the public verification key pk includes digitally signing using an off-line digital signature scheme.
8. A method of conveying information about certificates, comprising:
having an authority digitally sign, using a first digital signature scheme, the public key pk of a second signature scheme, wherein pk's secret key is known to an other entity;
at every date D of a sequence of dates, having the other entity produce a digitally signed certificate revocation status, signed with respect to pk, using a single digital signature that provides a positive and explicit statement about the validity status at date D of each not-yet-expired certificate in a plurality of certificates;
providing the digitally signed certificate revocation status to a directory; and
having the directory store the latest received digitally signed certificate revocation status to be provided as a response to an inquiry about revocation status of a particular one of the plurality of certificates.
9. A method, according to claim 8 , wherein having the authority digitally sign pk includes having pk be a quantity within the plurality of certificates and having the authority digitally sign at least one of the plurality of certificates using the first signature scheme.
10. A method, according to claim 8 , wherein the certificate revocation status includes a revocation signature indicating certificates that have been revoked together with revocation dates thereof.
11. A method, according to claim 8 , wherein the directory is not trusted and can not make a valid certificate revoked and can not make a revoked certificate valid.
12. A method, according to claim 8 , wherein each of the plurality of certificates has a serial number.
13. A method of obtaining information about a particular certificate, comprising:
receiving from an other entity a digitally signed certificate revocation status that uses a single digital signature to provide a positive and explicit statement about the validity status of each not-yet-expired certificate in a plurality of certificates at date D in a sequence of dates, wherein the plurality of certificates includes the particular certificate;
confirming that the certificate revocation status has been digitally signed by a trusted entity; and
if the certificate revocation status has been digitally signed by a trusted entity, extracting the information about the particular certificate from the certificate revocation status.
14. A method, according to claim 13 , wherein the certificate revocation status includes a revocation signature indicating certificates that have been revoked together with revocation dates thereof.
15. A method according to claim 13 , wherein the other entity is not trusted and can not make a valid certificate revoked and can not make a revoked certificate valid.
16. A method, according to claim 13 , wherein each of the plurality of certificates has a serial number.
17. A method, according to claim 13 , further comprising:
prior to receiving the digitally signed certificate revocation status, sending a message to the other entity requesting information about the particular certificate.
18. A method, according to claim 13 , wherein the trusted entity is an authority.
19. A method, according to claim 18 , wherein the authority previously issued the particular certificate.
20. A method, according to claim 13 , wherein the trusted entity is an entity other than an authority and wherein the certificate revocation status is digitally signed using a key pk relative to a signature scheme that is different from a signature scheme used by the authority.
21. A method, according to claim 20 , wherein the authority digitally signs pk.
22. A method of providing information about a particular certificate, comprising:
receiving from an other entity a digitally signed certificate revocation status that uses a single digital signature to provide a positive and explicit statement about the validity status of each not-yet-expired certificate in a plurality of certificates at date D in a sequence of dates, wherein the plurality of certificates includes the particular certificate; and
providing the digitally signed certificate revocation status to a user.
23. A method according to claim 22 , wherein the certificate revocation status includes a revocation signature indicating certificates that have been revoked together with revocation dates thereof.
24. A method, according to claim 22 , wherein each of the plurality of certificates has a serial number.
25. A method, according to claim 22 , further comprising:
prior to providing the digitally signed certificate revocation status, receiving a message from the user requesting information about the particular certificate.
26. A method, according to claim 22 , wherein the certificate revocation status is digitally signed by an authority.
27. A method, according to claim 26 , wherein the authority previously issued the particular certificate.
28. A method, according to claim 22 , wherein the certificate revocation status is digitally signed by an entity other than an authority using a key pk relative to a signature scheme that is different from a signature scheme used by the authority.
29. A method, according to claim 28 , wherein the authority digitally signs pk.