Subject: RE: Proposal for a new CRL extension

From: Paul Hoffman / IMC <[email-masked]>
Date: Thu, 12 Nov 1998 13:36:55 -0800

>If I am not mistaken, CRL's are signed.  How can you verify the signature
>unless you read the entire CRL?

Your read the entire CRL once to verify the signature. You store the CRL
with some marking that it is valid. You later read it looking for certificates.

Yes, you could extract and sort the certificates when you validated the
CRL, but that means many more steps than just keeping the CRL in some place
that you trust.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: EKR <[email-masked]>
Date: 12 Nov 1998 15:03:46 -0800

> CRL, but that means many more steps than just keeping the CRL in some place
Paul,
This really isn't that useful an optimization. Firstly, pretty 
much every ASN.1 codec I know of decodes the entire message
in one shot, so you've got to run over the entire message
anyway. The extra comparisons aren't that expensive.

But, for the sake of argument, let's assume that you have
an ASN.1 codec that is incremental. You still can't use
binary search, because you have to at least partially decode
entry n in order to know where entry n+1 starts. Consequently,
you now have to use linear search, so on average you have to
read half the CRL. This seems like a lot of standardization
work for a factor of two speedup.

-Ekr

-- 
[Eric Rescorla                                   [email-masked]]