CRLite+ – Lightweight Certificate Revocation Extension
Lightweight Browser Extension for Dynamic Certificate Revocation Enforcement
University of Illinois ChicagoMotivation
Mozilla's CRLite proves local Bloom filter-based checking works. CRLite+ brings this approach to Chrome, demonstrating fast, private revocation is achievable for Chromium browsers.
Solution
Hybrid revocation scheme: static cascaded Bloom filters (blacklist + whitelist) for known revocations, dynamic filters for real-time updates. Chrome extension intercepts certificates, performs local lookups, and blocks revoked domains. Node.js backend manages revocation lists; Python generates filter cascades.
- Cascaded Bloom Filters – Two-layer architecture (blacklist + whitelist) eliminates false positives while keeping memory under 512KB.
- Local Verification – All checks performed client-side, no network roundtrips, zero privacy leaks.
- Real-Time Enforcement – Chrome extension intercepts certificates, performs lookups in 2-5ms, blocks revoked domains instantly.
- Hybrid Scheme – Static pre-computed filters for known revocations, dynamic filters for real-time updates.
- 100% Accuracy – Zero false positives through cascade architecture, successfully detects all revoked certificates.
- Cascaded Bloom Filters – Two-layer architecture eliminates false positives, <512KB memory
- Privacy-Preserving – All checks local, zero network roundtrips, no browsing leaks
- Real-Time Enforcement – 2-5ms checking, instant domain blocking
- Hybrid Scheme – Static filters for known revocations, dynamic for real-time updates
- 100% Accuracy – Zero false positives, detects all revoked certificates
Design Process
Modular three-component architecture: Python generates static filter cascades, Node.js backend fetches certificates and manages revocation lists, Chrome extension performs real-time validation. Evaluation simulated revocations by injecting trusted domains to verify complete enforcement flow.
Requirement Analysis
Analyzed CRLs and OCSP limitations: CRLs are large and slow, OCSP adds latency and leaks privacy. Studied Mozilla's CRLite to understand cascaded Bloom filters. Requirements: sub-10ms checking, zero network roundtrips, privacy-preserving, Chromium-compatible.
Analysis revealed existing mechanisms fail to balance performance, privacy, and scalability. CRLite's approach provided the foundation for CRLite+.
- Identified core needs: low latency, privacy, scalability, Chromium compatibility
- Studied CRLite's cascaded Bloom filter approach
- Defined success: 100% accuracy, <1MB memory, negligible overhead
System Architecture
Three-component system: Python filter generator, Node.js backend for certificate retrieval, Chrome extension for enforcement. Cascaded Bloom filters: blacklist (revoked serials) + whitelist (eliminates false positives). Uses MurmurHash3 for performance, SHA-256 for certificate hashing.
Modular architecture enables independent optimization. Cascaded filters provide accurate, scalable checking with minimal memory overhead.
- Python generates static filter cascades
- Node.js backend manages certificates and revocation lists
- Chrome extension performs real-time validation
- Cascaded filters ensure zero false positives with minimal memory
Data Pipeline
Pipeline: Node.js backend creates raw TLS connections, extracts certificate serials, maintains revocation lists. Python processes data to generate static filter cascades. JSON endpoints enable extension-backend communication for live updates.
Pipeline separates static filter construction from dynamic updates, enabling efficiency and flexibility while keeping revocation lists current.
- Node.js fetches certificates via raw TLS, extracts serials with SHA-256
- Python generates cascaded filters from revocation lists
- JSON API enables dynamic updates without filter regeneration
Implementation
Chrome extension (Manifest V3) intercepts certificates during TLS handshake, performs Bloom filter lookups, blocks revoked domains. Node.js backend manages revocation lists via REST API. Python generates filter cascades. Achieves 2-5ms checking overhead.
Fully functional extension with real-time revocation checking. Modular codebase enables efficient interception, fast lookups, and seamless blocking.
- Extension: certificate interception, cascade lookup (blacklist → whitelist), domain blocking
- Backend: raw TLS connections, certificate extraction, revocation list management
- Python: filter generation with configurable parameters
Evaluation & Results
Simulated revocations by injecting trusted domains (github.com, uic.blackboard.com) to verify complete enforcement flow. Results: 100% detection accuracy, 2-5ms checking time, zero false positives. Iterations optimized filter parameters, reducing memory to <512KB (static) and <200KB (dynamic).
Evaluation confirms accurate revocation detection with minimal overhead. Iterations optimized parameters, resulting in a practical client-side revocation system for Chromium browsers.
- 100% accuracy across multiple domains and certificate types
- 2-5ms average checking time, negligible page load impact
- Zero false positives through cascade architecture
- Memory optimized: <512KB static, <200KB dynamic
Reflection
Outcomes
Achieved 100% detection accuracy with 2-5ms checking overhead. Cascaded filters eliminated false positives. Complete enforcement flow validated—from certificate parsing to domain blocking. Proves fast, privacy-respecting revocation is practical for Chromium browsers.
If I had more time
Future: integrate real CA feeds for live CRL/OCSP conversion, support intermediate CA revocations, native browser integration, revocation transparency logging.