摘要： CRL是PKI中处理证书撤销的最常用方法。通过分析X.509v1CRL存在的问题，提出了在大规模PKI中评价CRL分发机制的5个准则。一种好的分发机制应该尽可能减小信任方所需下载的CRL大小，降低CRL库的峰值负荷和/或平均负荷，减轻CRL的时间碎片问题，同时可以根据信任方的不同需求提供不同的服务，可以动态更新CRL的分割策略。如果还可以不对原客户端程序做很大改动，甚至不需要改动，那就更好了。另外利用这些评价准则，对当前主要的几种CRL分发机制的改进方法，包括CRL分发点、Delta－CRL、重叠发布CRL、最新撤销信息指针和重定向指针，详细地进行了分析和比较。

关键词: 作废证书列表（CRL）, CRL分发机制, CRL分发点, Delta－CRL, 重叠发布CRL, 最新撤销信息指针, 重定向指针

Abstract: Distributing a Certificate Revocahon List (CRL) is the most common Proposed method to deal with certificate revocation in aPKL In this paper, after analyzing some problems existing in X.509 v1 CRLs, five critcria are proposed to evaluate CRL distributionmechanisms in a large-scale PKI. An effective distribution mechanism should minimize the size of CRLs relying parties have to download andthe peak and average loads on CRL repositories, alleviate the time-granularity problem, provide different levels of service to relying partiesdepending on their needs, and dynamically update the CRL partitioning strategy. It will be better if client applications needn't to be rewrittenwhen a new CRL distribution mechanism is deployed in PKIs. Using these criteria this paper makes a detailed analysis and comparison amongseveral alternahve CRL distribution mechanisms, such as CRL Distribution Point, Delta-CRL, Over-issued CRL, Freshest RevocationInformation Pointer and Redirect Pointer.

中图分类号: 

• TP393.08