Subject: RE: CRL number in CRL and ARL

From: Ambarish Malpani <[email-masked]>
Date: Wed, 9 Aug 2000 08:50:10 -0700

Hi Naruhito,
    If you are creating CRLs and ARLs that are not complete (i.e.
don't contain all the entries the other does), it is very
important that you use the CRLDP method of doing it. Put in
CRLDP extensions in the certificates and IDP (Issuing Distribution
Point) extensions in your CRLs/ARLs.

If you don't use the CRLDP mechanism, you run the risk of having
a bunch of applications misbehave with your CRLs.

Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
339 N. Bernardo Ave.                          http://www.valicert.com
Mountain View, CA 94043

> -----Original Message-----
> From: TAKIGUCHI Naruhito [mailto:[email-masked]]
> Sent: Tuesday, August 08, 2000 8:13 PM
> To: [email-masked]
> Subject: CRL number in CRL and ARL
> 
> 
> Hi, all.
> 
> I have a question about the cRLNumber extension.
> 
> For example, a CA issues CRL(end-entity certificate revocation list)
> and ARL(CA certificate revocation list).
> Which is correct (a) or (b) ?
> 
>     (a) In first CRL and ARL, the CRL number is 0.
>         In next CRL and ARL, the CRL number is 1.
> 
>         In other words, CRL and ARL have same value of the CRL number.
>         The CRL number is a monotonically increasing sequence number
>         for each CRL scope.
> 
>     (b) In first CRL, the CRL Number is 0.
>         In first ARL, the CRL Number is 1.
>         In next CRL, the CRL number is 2.
>         In next ARL, the CRL number is 3.
> 
>         In other words, the CRL number is monotonically increasing
>         sequence number for each CA.
> 
> Could anyone advice me?
> 
> Thanks in advance.
> 
> -----
> Naruhito TAKIGUCHI
> FUJITSU HOKURIKU SYSTEMS LTD.
>

---

From: TAKIGUCHI Naruhito <[email-masked]>
Date: Thu, 10 Aug 2000 11:59:24 +0900

Ambarish, 

> a bunch of applications misbehave with your CRLs.

Thank you. I agree with your advice.
But, I'm going to discussion about the CRL number.

I think that the method (a)(the CRL number is a sequece number for each
CRL scope) is better than the method (b) for a relying party.
RFC2459 and son of RFC2459 describe following :

   The CRL number is a non-critical CRL extension which conveys a mono-
   tonically increasing sequence number for each CRL issued by a CA.

Does "for each CRL issued by a CA" sentence mean the method (b) ?

Thanks in advance.

-----
Naruhito TAKIGUCHI