"Revocations Are Dead, Long Live Revocations"
The importance of the web’s public key infrastructure (PKI) cannot be overstated: it is what allows users to know with whom they are communicating online. Central to its correct operation is the ability to “revoke” certificates in the wake of a compromised key. For revocations to work: (1) website administrators must request to have their certificates revoked, (2) browser manufacturers must regularly check for revocations, and (3) above all, no one should share their private keys. Using Internet-wide measurements, I will show that all of these are violated on a regular basis, largely due to perverse economic incentives.  I will also present a promising path forward: a new system, CRLite, that compactly represents all revocations in only tens of kilobytes per day.  CRLite shows that, at last, it is feasible for every client to download every revocation everyday.

Dave Levin is an assistant professor in the School of Computer Science at the University of Maryland. His research empirically measures security on the Internet to understand how security breaks down, and he applies economics and cryptography to design and build new systems with provable and usable security. Levin studies the web's PKI, censorship avoidance, DNS root servers, and more. 

The Cybersecurity Lecture Series at Georgia Tech is a free, one-hour lecture from a thought leader who is advancing the field of information security and privacy. Invited speakers include executives and researchers from Fortune 500 companies, federal intelligence agencies, start-ups and incubators, as well as Georgia Tech faculty and students presenting their research. Lectures are open to all -- students, faculty, industry, government, or simply the curious.

Presented by the Institute for Information Security & Privacy