Homework #8Solutions.ppt

February 7, 2006 Practical Aspects of Modern Cryptography Homework #8Solutions Question 1 – Fun w/ Revocation VeriSign’s RSASecureServer.crl. As of 3am Wed., Feb. 22: Valid from 2/22/06 to 3/8/06 515,243 bytes in size 14,714 entries Assume that all of the certs listed on the CRL were issued within the past 12 months. VeriSign claims to have about 500,000 sites with “Secure Server IDs”, so assume that’s the universe from which 14,714 certs have been revoked. Question 1a Assume 200,000,000 users who will negotiate an SSL/TLS session with at least one of the 500,000 sites over the next two weeks. On average, how much bandwidth is VeriSign going to use per day distributing the RSASecureServer CRL? You may assume user requests for CRLs are evenly distributed throughout the CRL’s two-week validity period. Question 1a 200M users, CRLs last 14 days, so on average 1/14th of the users will have to download the CRL each day. 200M/14 = 14.285714M downloads/day 515,243 bytes/download ? ~7.360x1012 bytes of bandwidth per day Question 1b Assume there also exists an OCSP responder for the same data If the average size of an OCSP request/response message pair is 3KB, how many OCSP responses would the average user have to request from the VeriSign OCSP responder per day in order to generate the same about of bandwidth usage as the CRL downloading you calculated in Question 1(a)? Question 1b ~7.360x1012 bytes of bandwidth per day / 3KB/OCSP request/response pair ? 2.453x109 OCSP round-trips / 200,000,000 users ? ~12.267 OCSP requests/user/day Question 1c USG wants to issue a cert to each of 60 million passport holders. VeriSign is experiencing about a 3% revocation rate; assume that the same rate would apply for these certs. Approximately how big would the CRL be for the personal certs issued by the US Government? You may assume that each CRL entry requires 35 bytes of storage when ASN.1 encoded. Question 1c 60 million passport holders * 3% revocation rate ? 1.8 million rev