<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div><blockquote type="cite" class="">While working on a blockchain-based solution for remote identity<br class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">proofing, we came to realize that a blockchain with on-chain storage</div><div class="">can be used to implement the same functionality as a traditional PKI,</div><div class="">with remarkable advantages. In particular, the verifier can validate</div><div class="">a certificate chain on its local copy of the blochain without any</div><div class="">network access. Details can be found in this <a href="https://pomcor.com/2016/10/25/implementing-a-pki-on-a-blockchain/" class="">blog post</a> and in Section</div><div class="">3 of <a href="https://pomcor.com/techreports/BlockchainPKI.pdf" class="">this paper</a>. Comments welcome.</div></div></div></blockquote>How does using a blockchain differ from having a PKI broadcast its entire set of signed public certificates? Or, equivalently for reasonable efficiency, every delta to its set? (With a serial number, of course - and the entire delta signed by the CA - so that receivers could detect modifications or missed deltas.)</div><div><br class=""></div><div>A blockchain supports agreed-to modifications by anyone (to simplify the semantics). But a PKI has just one sender, broadcasting to many receivers. You don't need a blockchain for that, just signatures.</div><div><br class=""></div><div>A CRL blockchain - on which anyone could mark their own certificate as canceled - might make more sense, but even here it's the wrong semantics. If I believe my certificate should be invalidated ... that's *my* call and my call alone. The last thing I want to have to do is get a whole bunch of others on the blockchain to agree with me that it should be invalidated - it's *my* call, not theirs. My signature alone on the invalidation is sufficient proof that I sent the invalidation and it should be honored. I want some form of reliable broadcast to ensure that my invalidation has reached all the relevant parties, but that's a much weaker (and cheaper to produce) primitive than a blockchain.</div><div><div> -- Jerry</div><div class=""><br class=""></div></div><br class=""></body></html>