![](bg3.png)
longer trustworthy [15]. It is important that the distribution of the CRL is done effi-
ciently in order to allow that the knowledge about untrustworthy nodes can be spread
quickly to the entire network.
In the particular case of VANETs, previous works assume that the entire CRL
may be delivered by broadcasting it directly from RSUs to OBUs [10], and then dis-
tributed among OBUs cooperatively [14]. However, the large size of VANETs, and
consequent large size of the CRLs, makes this approach infeasible due to the overhead
it would cause to network communications. This issue is further increased with the use
of multiple pseudonyms for the nodes, what has been suggested to protect privacy and
anonymity of OBUs [16].
Since there are almost one thousand million cars in the world [11], considering
the use of pseudonyms, a direct conclusion is that the number of revoked certificates
might reach soon the same amount, one thousand million. On the other hand, assuming
that each certificate takes at least 224 bits, in such a case the CRL size would be 224
Gbits, what means that its management following the traditional approach would not
be efficient. Even though regional CAs were used and the CRLs could be reduced to 1
Gbit, by using the 802.11a protocol to communicate with RSUs in range, the maximum
download speed of OBUs would be between 6 and 54 Mbit/s depending on vehicle
speed and road congestion, so on average an OBU would need more than 30 seconds to
download a regional CRL from an RSU.
A straight consequence of this size problem is that a new CRL cannot be issued very
often, what would affect the freshness of revocation data. On the other hand, if a known
technique for large data transfers were used for CRL distribution as solution for the size
problem, it would result in higher latencies, what would also impact in the revocation
data validity. Consequently, a solution not requiring the distribution of the full CRL
from RSUs to OBUs, like the one proposed in this work, would be very helpful for the
secure and efficient operation of VANETs.
In particular, to improve efficiency of communication and computation in the man-
agement of revoked public-key certificates in VANETs, some authors have proposed
the use of particular ADSs such as Merkle trees [12] and skip lists [6] [9]. However,
to the best of our knowledge no previous work has described in detail the use of k-ary
trees in general as ADSs for the management of certificate revocation.
In general, a hash tree is a tree structure whose nodes contain digests that can be
used to verify larger pieces of data [13]. The leaves in a hash tree are hashes of data
blocks while nodes further up in the tree are the hashes of their respective children so
that the root of the tree is the digest representing the whole structure. Hash trees usually
require the use of a cryptographic hash function in order to prevent collisions. Most
implementations of hash trees are binary, but this work proposes the use of the more
general structure of k-ary trees because when combining it with a particular choice of
cryptographic hash function, it is possible to optimize the update of the hash tree.
This paper proposes the use of a new version of Keccak as cryptographic hash func-
tion in the hash tree. Keccak is the cryptographic hash function used in the new SHA-3
standard [17]. The requirements set by NIST for SHA-3 candidates included classical
security properties of hash functions, such as collision resistance, preimage resistance
and second preimage resistance [1]. Different types of implementations of SHA-3 fi-
5