Tham khảo tài liệu 'hacker professional ebook part 188', công nghệ thông tin, kỹ thuật lập trình phục vụ nhu cầu học tập, nghiên cứu và làm việc hiệu quả | What are Certificate Revocation Lists CRLs A Certificate Revocation List CRL is a list of public keys that have been revoked before their scheduled expiration date. There are several reasons why a key might need to be revoked and placed on a CRL. A key might have been compromised. A key might be used professionally by an individual for a company for example the official name associated with a key might be Alice Avery Vice President Argo Corp. If Alice were fired her company would not want her to be able to sign messages with that key and therefore the company would place the key on the CRL. When verifying a signature one can check the relevant CRL to make sure the signer s key has not been revoked. Whether it is worth the time to perform this check depends on the importance of the signed document. CRLs are maintained by certifying authorities CAs and provide information about revoked keys originally certified by the CA. CRLs only list current keys since expired keys should not be accepted in any case when a revoked key is past its original expiration date it is removed from the CRL. Although CRLs are maintained in a distributed manner there may be central repositories for CRLs that is sites on networks containing the latest CRLs from many organizations. An institution like a bank might want an in-house CRL repository to make CRL searches feasible on every transaction. What happens when a key expires In order to guard against a long-term factoring attack every key must have an expiration date after which it is no longer valid. The time to expiration must therefore be much shorter than the expected factoring time or equivalently the key length must be long enough to make the chances of factoring before expiration extremely small. The validity period for a key pair may also depend on the circumstances in which the key will be used although there will also be a standard period. The validity period together with the value of the key and the estimated strength
