Certificate Revocation List

Description

The Certificate Revocation List (CRL) is a fundamental component of the Public Key Infrastructure (PKI) employed within 3GPP systems for security management. It functions as a digitally signed list, issued by a Certification Authority (CA), enumerating the serial numbers of certificates that have been revoked and are no longer considered valid. The list includes the revocation date and often the reason for revocation (e.g., key compromise, CA compromise, affiliation changed, cessation of operation, certificate hold). The CRL's signature ensures its authenticity and integrity, allowing relying parties to trust its contents.

In the 3GPP architecture, CRLs are utilized by various network functions and user equipment (UE) to perform certificate validation during security procedures. For instance, when a UE authenticates to the network via the Authentication and Key Agreement (AKA) framework enhanced with certificate-based methods, or when network functions mutually authenticate each other (e.g., in SBA - Service-Based Architecture), the presented certificates must be validated. This validation process involves checking the certificate's signature chain, validity period, and its revocation status by consulting the relevant CRL. The CRL can be distributed via specific protocols or fetched from a pre-configured distribution point (CRL Distribution Point - CDP) often embedded within the certificate itself.

The management and distribution of CRLs involve several key entities: the Certification Authority (CA) that issues and signs the CRL, the Repository that stores and disseminates the CRL, and the Relying Party (e.g., UE, AMF, SMF) that retrieves and processes it. The process works by the CA periodically generating and publishing updated CRLs. Relying parties must then obtain these updates, typically over HTTP/LDAP protocols, to maintain an up-to-date view of the revocation status. The frequency of CRL issuance (the CRL issuance period) is a critical parameter balancing security freshness against network load and client processing. A relying party caches a CRL until its "nextUpdate" time, after which it must fetch a newer version to ensure continued accurate validation.

CRLs play a vital role in the overall security posture of 3GPP networks by enabling the timely invalidation of credentials that should no longer be trusted. This is essential for mitigating risks associated with stolen private keys, compromised network functions, or mis-issued certificates. Without an effective revocation mechanism like CRL, even expired certificates or those associated with breached entities could potentially be used in attacks, undermining the trust model of the entire PKI. Therefore, CRL validation is an integral step in certificate path validation procedures specified in 3GPP security specifications.

Purpose & Motivation

The CRL technology exists to address the critical problem of credential invalidation within a Public Key Infrastructure (PKI). Digital certificates, which bind an entity's identity to a public key, have a long validity period (often months or years). If a corresponding private key is compromised, the entity is no longer authorized, or the certificate was issued in error, it is imperative to invalidate that certificate immediately rather than waiting for its natural expiration. The CRL provides a standardized, scalable method to disseminate this revocation information to all relying parties across the network.

Historically, without a revocation mechanism, once a certificate was issued, it remained technically valid until its expiry date, creating a significant security window of vulnerability. The creation of CRLs was motivated by the need to close this window and provide a means for a Certification Authority to assert which certificates are no longer trustworthy. In 3GPP networks, as services evolved from 4G to 5G and adopted more cloud-native, service-based architectures with increased use of certificate-based authentication (e.g., for network function service communication, IoT device onboarding), the reliable and efficient management of certificate lifecycles, including revocation, became even more paramount.

The CRL solves the limitations of previous ad-hoc or non-existent revocation methods by providing an authenticated, periodically updated list. It addresses the challenge of scale by allowing distribution via standard web protocols. While alternative mechanisms like the Online Certificate Status Protocol (OCSP) offer real-time checks, CRLs remain a fundamental, widely supported, and sometimes preferred method due to their simplicity, ability to work offline once cached, and suitability for environments where constant online queries are not feasible or desired, forming a cornerstone of 3GPP's certificate validation framework.

Key Features

• Digitally signed list ensuring authenticity and integrity
• Contains serial numbers of revoked certificates with revocation time and reason
• Periodically issued and updated by the Certification Authority (CA)
• Distributed via standard protocols (e.g., HTTP, LDAP) from a Repository or CDP
• Integral part of certificate path validation procedures in 3GPP security
• Enables offline validation capability when cached by relying parties

Evolution Across Releases

Defining Specifications