Subject: Proposal for a new CRL extension

From: Paul Hoffman / IMC <[email-masked]>
Date: Thu, 12 Nov 1998 12:16:06 -0800

The entries in CRLs are not ordered. This means that a CRL-reading client
must read the entire CRL to know if a particular certificate is revoked.
That's pretty wasteful, it seems to me.

I would like to propose a new non-critical CRL extension that would say
that the revokedCertificates sequence is in the ascending order either by
userCertificate or by revocationDate. I don't see any problem with this,
but wanted input before I wrote up the draft.

Comments?

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: "Phillip M Hallam-Baker" <[email-masked]>
Date: Fri, 13 Nov 1998 10:44:05 -0500

I think the idea is a good one, but only up to a point. I considered an
ordered CRL extension at length earlier in the year when I for some
reason I was spending a lot of time thinking about CRLs.

The problem that was put to me was one of backwards compatibility. If
the extension is to be any use in a legal sense it has to be marked 
critical which breaks backwards compatibility.

Also I started to go off the idea when I rediscovered scopes for OCDP
since the length of the CRL can then be absolutely bounded to an arbitrary
limit.

The CRL processing problem is much less of a problem IMNSHO as the 'we
can't stuff a darn CRL into our IPSEC handshake' problem.

Its a valid point though and the cost of adding it to the profile would
not be very high. If the list thinks there is value we could add the 
proposal to the OCDP draft, rename it extended certificate processing and
use it as a vehicle for similar CRL optimizations that may turn out to be
usefull.

The application I would envisage is for managing very large archival CRLs
where the cost of a possibly unnecssary extension is not very significant.

		Phill

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf
> Of Paul Hoffman / IMC
> Sent: Thursday, November 12, 1998 3:16 PM
> To: [email-masked]
> Subject: Proposal for a new CRL extension
> 
>

---

From: Paul Koning <[email-masked]>
Date: Fri, 13 Nov 1998 12:43:25 -0500

>>>>> "Phillip" == Phillip M Hallam-Baker <[email-masked]> writes:

 Phillip> I think the idea is a good one, but only up to a point. I
 Phillip> considered an ordered CRL extension at length earlier in the
 Phillip> year when I for some reason I was spending a lot of time
 Phillip> thinking about CRLs.

 Phillip> The problem that was put to me was one of backwards
 Phillip> compatibility. If the extension is to be any use in a legal
 Phillip> sense it has to be marked critical which breaks backwards
 Phillip> compatibility.

I don't understand that.

If you sort the CRL and indicate this, and I don't recognize the
extension, that has to mean that I don't have code that optimizes the
handling of sorted CRLs.  Instead, I treat all CRLs as unsorted.

Nothing bad happens.  Since nothing bad happens, the extension must
not be marked critical.

	paul