基于PKI的证书撤销树方案的研究

Certificate Revocation Tree Scheme Based on PKI

文中介绍了当前公钥基础设施中静态证书撤销树、线索二叉排序Hash树、平衡二叉排序Hash树以及2-3Hash树方案。对具有一定规模结点的上述后三种方案进行了实验模拟,实验结果表明:平衡二叉排序Hash树方案的证书验证长度较短,但是在树更新时,耗费的时间比其它两种方案长;2-3Hash树方案在验证已撤销证书的有效性时,其验证长度与平衡二叉排序Hash树方案的证书验证长度相差不大,但在验证有效证书的有效性时,其验证长度大约是平衡二叉排序Hash树方案的证书验证长度的2倍。

The principal PKI schemes are described in this paper, including the static certificate revocation tree, threaded binary sorted Hash tree, the balanced binary sorted Hash tree and 2-3 Hash tree, and the subsequent three schemes with certain amount of nodes are simulated. The result shows that the balanced binary sorted Hash tree scheme has shorter certificate verification length, but requires longer time when renewing the certificate; the certificate-verification length of the 2-3 Hash tree one is more or less the same with that of the balanced binary sorted Hash tree scheme, but the later＇s verification length is almost twice the former＇s when verifying the validity of the valid certificates.