Why there is time period of key pairs in public key cryptography?

Question

In Public Key Infrastructure, every key pair is associated with its life time. I don't understand why we have a life time when we have functionality such as certificate revocation list(crl) which tells the user when any key is invalid. That is we can use any key pair for infinite amount of time or till its purpose is finished (for e.g. the Organization for which the key pair was made closed). This way we can save the cost of renewing certificate when the new key is made.

The only intuitive answer (I got) is it reduces maintenance cost of CAs, since there will be loads of public keys it has to maintain. Otherwise, they can just scrap of keys whose time period is over.

Answer 1

The only intuitive answer (I got) is it reduces maintenance cost of CAs, since there will be loads of public keys it has to maintain. Otherwise, they can just scrap of keys whose time period is over.

No, that might be a reason but this is more due to several security reasons.

The first reason: better change your password every x months.

Lets consider a simple scheme. Imagine you use the same password on every website (which you should not be doing: would you use the same brush for your teeth and for your toilets ?). You can assume that you can change your password anytime (same principle to revocation certificate). But you may forget to change your password on some website. If one of these is compromised, why not some other by domino effect ? In order to avoid such problem, we generally have a policy that makes user change their password every x > 0 months. For your key pairs this is the same idea.

The second (and more important) reason: the increasing power of computers makes old keys insecure with time. This is due to the increasing power for factoring big numbers. A 1024 bit key may have been considered secure some years ago, but not anymore. Therefore to prevent people to use it, a life time is associated.

Answer 2

CRLs have problems, for example:

online revocation checks are slow and compromise privacy.

What happens if a client can't get through to a CRL server? If the client refused to go ahead until the CRL server was available, then attacker could cause a mass denial of service by dropping TCP packets targeted at this server. This would grind the Internet to a halt. this is not acceptable for security (a trivial target to compromise internet availability) or usability.