RevDNS: Reliable and Decentralized Certificate Revocation via DNS#

Protick Bhowmick, Dave Levin, Taejoong Chung (Virginia Tech, U. Maryland)

Why: Web-PKI revocation is broken and OCSP-over-CDN recentralizes trust (Akamai serves ~62% of revocation responses) — directly relevant to the PM's PKI/identity interest.

What: A DNS-based revocation scheme where resolvers answer ~99.8% of checks locally without contacting a CA, with no added latency and no extra user disclosure.

How: Revoked serials live in DNSSEC-signed TXT records; NSEC proofs enable aggressive negative caching; a large CA like Let's Encrypt can publish 612M certificates in a 345MB zone.

Where applicable: General web-PKI proposal; a concrete alternative to OCSP and short-lived certs that keeps revocation authority with CAs.