Performance optimizations for certificate revocation

Certificate revocation is an outstanding problem in PKI. This paper extends Naor´s scheme of dynamic hash tree in order to optimize performance. Set of revoked certificates is divided into groups. In each group, proofs for certificate status are computed by using one-way accumulator, while all groups are still organized in hash tree. The main advantage of the proposed scheme is that it can adjust traffic between CA-to-directory and directory-to-user according to certificate update rate and query rate in applications, thus can remarkably reduce overall traffic consumed for certificate revocation, and can efficiently accommodate a wide range of scenarios. Compared with Naor´s origin scheme, performance analysis shows it can reduce traffic by about 50% in typical environments.