基于二次剩余问题的证书撤销方案

A Certificate Revocation Scheme Based on Quadratic Residues Problem

证书撤销状态发布是PK I一个最为关键的环节.评价一个证书撤销状态发布方案的指标主要包含证书状态发布通信量、发布的实时性、访问平稳性、目录服务器安全要求、状态验证计算复杂度等五个方面.在对目前已有证书状态发布方案分析的基础上,本文提出基于二次剩余难解问题的证书撤销状态发布方案.该方案在状态发布的实时性、发布数据通信量、访问发生平稳性、对目录服务器的安全要求等方面都有十分理想的效果,其计算复杂度也小于OCSP、CRT和CRL.

The revocation of certificates is very important to PKI. The sticking points that influence a certificate revocation scheme heavily are the traffic for distribution of certificate status, the time the CA spent to flush those status to directory, whether the access to directory comes on smoothly, whether there is a strict requirement on the security of the directory, and computation complexity of status verification. Following the analysis of the existing certificate revocation schemes, we propose a new certificate revocation scheme based the difficulty of resolving the Quadratic Residues problem. This new scheme is good at the traffic needed to distribution the status, the time to flush the status to the directory and also good at the smoothness of access of users to the directory, and requires nothing about the security of the directory. And then we show that this new scheme has lower computation complexity than that of OCSP, CRL and CRT.