The lie made into the rule of the world - Ezekiel 23:20

  • 2 Posts
  • 48 Comments
Joined 10 months ago
cake
Cake day: October 22nd, 2024

help-circle



  • Quite impressive

    CRLite is a low-bandwidth, low-latency, privacy-preserving mechanism for distributing certificate revocation data. A CRLite aggregator periodically encodes revocation data into a compact static hash set, or membership test, which can can be downloaded by clients and queried privately. We present a novel data-structure for membership tests, which we call a clubcard, and we evaluate the encoding efficiency of clubcards using data from Mozilla’s CRLite infrastructure. As of November 2024, the WebPKI contains over 900 million valid certificates and over 8 million revoked certificates. We describe an instantiation of CRLite that encodes the revocation status of these certificates in a 6.7 MB package. This is 54% smaller than the original instantiation of CRLite presented at the 2017 IEEE Symposium on Security and Privacy, and it is 21% smaller than the lower bound claimed in that work. A sequence of clubcards can encode a dynamic dataset like the WebPKI revocation set. Using data from late 2024 again, we find that clubcards encoding 6 hour delta updates to the WebPKI can be compressed to 26.8 kB on average—a size that makes CRLite truly practical.

    It uses in essence a hyper optimised hashmap/bloomfilter, that can only check the presence or absence of a query.

    Here’s a prior implementation: https://github.com/bitwiseshiftleft/compressed_map

    Which in turn is based on https://engineering.fb.com/2021/07/09/data-infrastructure/ribbon-filter/