Defeating DoS: SIA vs AIA

A core architectural philosophy underlying high-assurance PKI implementations involves prioritizing Subject Information Access (SIA) over Authority Information Access (AIA).

While typical PKI engines build paths bottom-up using the AIA extension (following URIs supplied in unvalidated end-entity certificates), this exposes validation services to severe Denial of Service attacks—essentially cryptographic "Zip Bombs" where the service is tricked into downloading malicious or endless payloads.

By prioritizing SIA (a top-down whitelist from trusted issuers pointing to their own repositories) or failing closed on a locally curated cache, validators maintain high availability against adversarial payloads.

Note: While VSS embraces this philosophy conceptually, the current reference REST API leverages local intermediate caching and strict timeout bounds on AIA chasing to mitigate these risks. True SIA-driven path discovery remains an ongoing research area for Federal PKI.