A blockchain-based certificate revocation management and status verification system. Issue 104 (May 2021)

• Record Type: Journal Article
• Authors: Elloh Adja, Yves Christian; Hammi, Badis; Serhrouchni, Ahmed; Zeadally, Sherali
• Is Part Of: Computers & security. Issue 104(2021)
• Publication Date: 2021-05
• Subjects: Authentication -- Blockchain -- Bloom filter -- Certificate -- Revocation -- Decentralization -- PKI -- Security -- X509; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2021.102209
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Revocation management is one of the main tasks of the Public Key Infrastructure (PKI). It is also critical to the security of any PKI. As a result of the increase in the number and sizes of networks as well as the adoption of novel paradigms such as the Internet of Things and their usage of the web, current revocation mechanisms are vulnerable to single point of failures as the network loads increase. To address this challenge, we take advantage of blockchains power and resiliency in order to propose an efficient decentralized certificates revocation management and status verification system. We use the extension field of the X509 certificate's structure to introduce a field that describes to which distribution point the certificate will belong to if revoked. Each distribution point is represented by a Bloom filter filled with revoked certificates. Bloom filters and revocation information are stored in a public blockchain. We developed a real implementation of our proposed mechanism in Python and the Namecoin blockchain. Then, we conducted an extensive evaluation of our scheme using performance metrics such as execution time and data consumption to demonstrate that it can meet the needed requirements with high efficiency and low cost. Moreover, we compare the performance of our approach with two of the most well-known/used revocation techniques which are Online Certificate Status Protocol (OCSP) and Certificate Revocation List (CRL). The results obtained show that our proposed approach outperforms these current schemes.