OCSP responses have a 'nextUpdate' field, which is the expected time for the new revocation update and that the current revocation can be considered valid. The revocations can be cached by the intermediate cert servers, which I have seen used in designs which provide stapled responses. I have read that revocations are delivered immediately from the root CA to the intermediate CA.
In this case, what if there was a DoS attack to the root CA server so it is prevented from delivering the revocation? This could expose a window of opportunity, using the intermediate server's cached revocation entry, that would incorrectly advise an end user's client that a website cert is valid, when may be invalid. The user's client or browser could interact with a malicious site until the DoS is stopped, a phone call is made to all the intermediate servers, etc... up to 7 days.
There have been at least three DoS attacks on root name servers lasting at least an hour long, however I'm not sure how they would affect a CA server's ability to send outbound traffic. Perhaps they have side channels of getting the revocation list out.
Does anyone have any more information on the technical aspects of this and the possibility of this type of attack occurring? Also, I'm curious if anyone knows the caching infrastructure for CRLs and timing to expect a revocation to appear at a typical intermediate CA?
Chrome uses it's own propriety method of crawling CRLs and Google pushes them to the browser in chunks, called crlset. At first glance, OCSP has a better timing advantage compared to crlset, because it contacts authorized responders directly to get the revocations status, however after finding that some providers have implemented variably defined CRL cache update periods, I'm not sure it's actually better. Google claims that's their revocation list is updated daily and this is more frequent then other solutions.
Does anyone know the tradeoffs in security between OCSP and Google's crlset method? Specifically which has better timing and reliability to get the revocation response? Is Google's claim supported by evidence?