Podcast
Root Causes 272: OCSP's Privacy Problem


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
January 27, 2023
Concerns recently have been raised about OCSP real-time certificate checking and its potential to violate privacy. In this episode we unpack these concerns and discuss the alternatives to OCSP.
Podcast Transcript
Lightly edited for flow and brevity.
There are two alternatives. The first one we already mentioned. It’s CRL. Certificate Revocation List. Now we just said, well hold on a second. Doesn’t that sound like it’s inefficient? Yeah. In a way it is. And it probably will continue to be. There are techniques you can use to improve the efficiency. Like you can split and shard and segment your CRLs in various ways, for instance, so that you don’t have to give the entire CRL to everybody all the time. And that definitely makes the whole system more efficient and it means that the CAs’ CRL handling has to be more sophisticated, and they need their own schema and they need their own automation around that and you need to have software systems in place to do that and they need to work correctly, but it absolutely is an option.
And the other option of course – and this would be a radical change for the industry on the whole but could be, you know, it’s within the realm of what could be done from a computer science perspective - is just extraordinarily short certificate lifespans.
So let me just pick an arbitrary thing. Let’s suppose, hypothetically, that every SSL, every public SSL certificate was good for one day and it was replaced every day. Under those circumstances, if there was a problem with the certificate, that problem would be guaranteed to be gone in not more than 24 hours.

