A scalable scheme for certificate revocation

This paper proposes a scalable scheme for certificate revocation in public key infrastructure. In this scheme, the set of revoked certificates is divided into groups. In each group, proofs for certificate status are computed using one-way accumulators, while all groups are still organized in a hash tree. The main advantage of the proposed scheme is that it can adjust traffic between CA-to-directory and directory-to-user according to certificate update rate and query rate in applications, thus overall traffic for certificate revocation can be remarkably reduced and a wider range of scenarios can be accommodated. Compared with Naor's dynamic hash tree scheme, results show it can reduce traffic by about 50% in typical environments.