Subject: RE: OCSP and CSL

From: Ilan Shacham <[email-masked]>
Date: Wed, 2 Feb 2000 14:30:20 +0200

Antonio,

> Irene Gassko wrote:
> > 
> > At 09:46 AM 02/02/2000 +0100, Antonio Lioy wrote:
> > >2. once a cert is inserted into a CRL, it can *never* be
> > >deleted from it
> > 
> > This is not true. Expired certificates are deleted from CRL.
> 
> I disagree. A revoked cert MUST remain in the CRL even after
> its expiration date, because I may be willing to check if
> the cert was valid at some point in time before its natural
> expiration. That's why in a previous mail I said that that
> the size of a CRL is "monotonically increasing": you only
> add revoked certs to the CRL, and NEVER delete them, not
> even after their expiration.
> That's one of the major differences between CRL and OCSP:
> CRL are the history of all revoked certs by a certain CA,
> while OCSP offers information only for the "current" time
> slot (unless the OCSP server supports extensions to also
> look back at the history of the certs).

Section 3.3 of RFC 2459 clearly states:
	An entry may be removed from
   the CRL after appearing on one regularly scheduled CRL issued beyond
   the revoked certificate's validity period.

If you want to validate an "old" signature, all you have to do is
retrive the crl that was in order at the time of the signature, to 
see if the certificate was valid at the time.

Ilan
------------------------------------------------------------------------
Ilan Shacham				mailto:[email-masked]
Algorithmic Research Ltd.		http://www.arx.com
10 Nevatim St.,			phone:	972 - 3 - 9279540
Petach-Tikva, Israel			Fax:	972 - 3 - 9230864

---

From: Mirko Tedaldi <[email-masked]>
Date: Wed, 02 Feb 2000 15:36:26 +0100

>see if the certificate was valid at the time.

About it, do you know how commercial PKI softwares work? Do they remove 
expired certificates from CRL ?

Mirko Tedaldi.