Talk:Certificate revocation list

message: Matt, Actually, logically is not limited to mathematical relations. Rhetoric, one of the quadrivium (or was it trivium) was entirely, ahmm, rhetorical. Sorry about that. No I thought some about that phrasing and it should be retained as written, unless I got something conceptually wrong. I'm going back to look. ww 17:53, 17 Apr 2004 (UTC)
replies: text: Of course "logically" is not limited to mathematics, but in a subject that straddles mathematics and pragmatic security (such as cryptography), writing "logically necessary" will appear to some readers that there is some mathematical result that implies the need, which is the exact opposite of what you wish to convey. — Matt 18:05, 17 Apr 2004 (UTC)
replies: text: Matt, I don't see that implication is being made, but as you do something will have to change. I want to stress that there is an obligatory component to the necessity (lest you be a fool in your system design) and perhaps 'required' might be a reasonable choice of term. I'll go change it. ww 18:16, 17 Apr 2004 (UTC)
replies: text: "Required" works, thanks — Matt 18:46, 17 Apr 2004 (UTC)
replies: text: Matt, Thought we'd settled this as btw the two of us. What gives? ww 17:45, 19 Apr 2004 (UTC)
thread_title: logically necessary. Necessary??

message: Given that the CRL is signed by the CA's key, the problem of "subversion" as noted at the bottom of the article is really a non-issue. This key is "by definition" secure in a hierarchical PKI. Why mention subversion then? Yaronf 19:39, Apr 17, 2004 (UTC)
----
Yaronf, Given that some PKIs have been built w/o CRLs at all we can't assume rational design thought in the real world. Second, a subversion of the CA might yield a private key and so a test passing (suberted) CRL. Secure (and security analysis) dare not stop with 'by definition' cases. The real world doesn't necessarily follow the definition. Consider the Trusted Third Party or secure channel articles here, I've recently been over them in part to make this point (or something similar). 
Comments? (<-- best on my talk page, I've not watchlisted this article).
ww 19:49, 17 Apr 2004 (UTC)
thread_title: PKI / CRL subversion

message: Im still not sure how and where CRLs are used. 
#If I go check my mail, and I see the padlock symbol in my browser, is the certificate of my mail provider then being checked against a CRL, obtained from the issuing CA? And if yes, when is this CRL retrieved, everytime I check my mail or just once a week or something?
#Does every CA has its own CRL, that users can retrieve?
#Does the CRL only contain the revoked or "hold" serial numbers? And how big would such a CRL typically be?
#How long time is it between the "periodically" issued CRLs?
#Is OCSP replacing CRLs, could it replace CRLs? Are there any advantages of CRLs over OSCP?
I think the article needs more specific information to give a true understanding of how this is used.
Velle 12:11, 20 August 2006 (UTC)
thread_title:  Examples and more elaborated information needed 

message: What is a "PKI-enabled application" (term found in the article)? Im not sure, and if my guess is correct, this is a misleading word.
Velle 22:10, 20 August 2006 (UTC)
thread_title:  What is a "PKI-enabled application"? 

message: The article says, "No comprehensive solution to these problems is known, though there are multiple workarounds for various aspects of it, some of which have proven acceptable in practice," but no examples of workarounds or details are provided.  Either a summary of workarounds should be provided or a source needs to be referenced.
--Sho222 15:05, 22 March 2007 (UTC)
replies: text: Given that this has been tagged for verification since 2010, without support, claim deleted from text. Klbrain (talk) 07:03, 11 September 2018 (UTC)
thread_title:  Workarounds? 

message: The redirect from the Certificate Revocation List page mentions something about generalization - if noone is going to provide a specific example of a "Revocation List" outside of standard X.508/RFC 5280 CRLs, then the ambiguous title is pointless.
VESGroup (talk) 05:13, 19 July 2016 (UTC)
thread_title:  Why is the title of this article not "Certificate Revocation List"? 

message: This article (and the corresponding Online Certificate Status Protocol article) could be improved by consideration of non-browser scenarios; including enterprise and Internet-of-things. I am hoping for improvements that could guide decision making, and provide pointers for common methods of solving the issues. I plan to help improve the CRL vs. OCSP comparisons, by including an explanation of the impact of different common scenarios (browser vs. IoT vs. enterprise). Also want to take into account implementation context for OCSP responders and CDP (CRL distribution point) implementations.  — Preceding unsigned comment added by Trsm.mckay (talk • contribs) 19:39, 10 October 2019 (UTC)
thread_title:  CRL and non-browser scenarios