This is a 2D companion to the 3D Certificate Revocation Race, but instead of animating one single handshake timeline, it runs a Monte Carlo ensemble: hundreds of independent simulated revocation events, each occurring at a uniformly random instant relative to the method's own periodic clock, and plots the resulting detection-latency distribution for each method as it accumulates live.
CRL: revoked at random phase X ~ Uniform(0, T)
latency = T − X ⟹ latency ~ Uniform(0, T)
E[latency] = T/2, σ = T/√12
Stapling: independent clock, its own phase X' ~ Uniform(0, T)
latency ~ Uniform(0, T), E = T/2, σ = T/√12
Live OCSP: next client connection at phase Y ~ Uniform(0, C)
latency = Y + 2·RTT
E[latency] = C/2 + 2·RTT, σ = C/√12 (RTT is deterministic, adds no spread)
Note on fidelity: the 3D version drives its CRL publish tick and its OCSP-staple refresh tick off one shared timer, so in that sim CRL and stapling always report an (almost) identical latency. Real deployments rarely share a clock that way — a CA's CRL publish schedule and a server's own staple-refresh policy are independent processes — so this 2D model gives CRL and stapling their own independent random phase. With enough trials you can see their distributions are the same shape (both Uniform(0,T)) but not lock-step identical trial-by-trial, which is the more realistic picture.
- Network RTT — round-trip time added to every live OCSP query; deterministic, shifts the OCSP distribution right without widening it.
- Refresh interval T — how often the CRL point publishes and the server refreshes its staple; wider T stretches both uniform distributions and raises their mean.
- Connection rate — how often the client opens a new TLS connection; this is the only clock live OCSP depends on, since it asks fresh every time.
- Privacy leak stat — only live OCSP forces the client to reveal this exact site to the responder on every visit; that rate is 3600/C queries per hour, shown live. CRL and stapling never leak a per-visit signal to the responder from the client's side.
Real-world relevance: because the underlying arrival is uniform (not exponential), the mean of many independent trials converges to T/2 or C/2+2·RTT by the law of large numbers — the same reasoning security engineers use to bound "worst-case revocation propagation delay" when picking a CRL or staple refresh interval for a production PKI.