Subject: RE: CRL number in CRL and ARL

From: Ambarish Malpani <[email-masked]>
Date: Wed, 9 Aug 2000 22:33:13 -0700

If you are using CRLDPs, the numbering for each DP is independent.

It is okay to number them in the following way:

Time                DP1                     DP2
1                    10                      5
2                    12                      17
3                    15                      18
4                    99                     201
5                   202                     202

Or any other interesting scheme you would prefer, as long as
the numbers for DP1 are monotonically increasing and the
numbers for DP2 are monotoncally increasing.

Note: This example is *not* meant to imply that you even need to
issue both DPs at all the times specified.

Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
339 N. Bernardo Ave.                          http://www.valicert.com
Mountain View, CA 94043

> -----Original Message-----
> From: TAKIGUCHI Naruhito [mailto:[email-masked]]
> Sent: Wednesday, August 09, 2000 7:59 PM
> To: [email-masked]
> Subject: Re: CRL number in CRL and ARL
> 
> 
> Ambarish, 
> 
> >     If you are creating CRLs and ARLs that are not complete (i.e.
> > don't contain all the entries the other does), it is very
> > important that you use the CRLDP method of doing it. Put in
> > CRLDP extensions in the certificates and IDP (Issuing Distribution
> > Point) extensions in your CRLs/ARLs.
> > 
> > If you don't use the CRLDP mechanism, you run the risk of having
> > a bunch of applications misbehave with your CRLs.
> 
> Thank you. I agree with your advice.
> But, I'm going to discussion about the CRL number.
> 
> I think that the method (a)(the CRL number is a sequece 
> number for each
> CRL scope) is better than the method (b) for a relying party.
> RFC2459 and son of RFC2459 describe following :
> 
>    The CRL number is a non-critical CRL extension which 
> conveys a mono-
>    tonically increasing sequence number for each CRL issued by a CA.
> 
> Does "for each CRL issued by a CA" sentence mean the method (b) ?
> 
> Thanks in advance.
> 
> > Regards,
> > Ambarish
> > 
> > 
> ---------------------------------------------------------------------
> > Ambarish Malpani
> > Architect                                                
> 650.567.5457
> > ValiCert, Inc.                                  
> [email-masked]
> > 339 N. Bernardo Ave.                          
> http://www.valicert.com
> > Mountain View, CA 94043
> > 
> > 
> > > -----Original Message-----
> > > From: TAKIGUCHI Naruhito [mailto:[email-masked]]
> > > Sent: Tuesday, August 08, 2000 8:13 PM
> > > To: [email-masked]
> > > Subject: CRL number in CRL and ARL
> > > 
> > > 
> > > Hi, all.
> > > 
> > > I have a question about the cRLNumber extension.
> > > 
> > > For example, a CA issues CRL(end-entity certificate 
> revocation list)
> > > and ARL(CA certificate revocation list).
> > > Which is correct (a) or (b) ?
> > > 
> > >     (a) In first CRL and ARL, the CRL number is 0.
> > >         In next CRL and ARL, the CRL number is 1.
> > > 
> > >         In other words, CRL and ARL have same value of 
> the CRL number.
> > >         The CRL number is a monotonically increasing 
> sequence number
> > >         for each CRL scope.
> > > 
> > >     (b) In first CRL, the CRL Number is 0.
> > >         In first ARL, the CRL Number is 1.
> > >         In next CRL, the CRL number is 2.
> > >         In next ARL, the CRL number is 3.
> > > 
> > >         In other words, the CRL number is monotonically increasing
> > >         sequence number for each CA.
> > > 
> > > Could anyone advice me?
> > > 
> > > Thanks in advance.
> > > 
> > > -----
> > > Naruhito TAKIGUCHI
> > > FUJITSU HOKURIKU SYSTEMS LTD.
> > > 
> 
> -----
> Naruhito TAKIGUCHI
> FUJITSU HOKURIKU SYSTEMS LTD.
>

---

From: TAKIGUCHI Naruhito <[email-masked]>
Date: Thu, 10 Aug 2000 20:51:48 +0900

Ambarish,

> issue both DPs at all the times specified.

Thank you very much.
I see that the CRL number is a monotonically increasing
number for each CRL scope.

But, in your example, the CRL number is not a sequence number.
Is this right?

-----
Naruhito TAKIGUCHI

---

From: "David Chadwick" <[email-masked]>
Date: Mon, 21 Aug 2000 18:50:21 +0100

From:           	Ambarish Malpani <[email-masked]>
To:             	"'TAKIGUCHI Naruhito'" 
<[email-masked]>, [email-masked]
Subject:        	RE: CRL number in CRL and ARL
Date sent:      	Wed, 9 Aug 2000 22:33:13 -0700 

Ambarish,

How does your unique and apparently random numbering scheme 
allow the CRL user to quote 
"detect whether CRLs issued prior to the one being processed 
were also seen and processed."

I dont believe it can, and therefore does not fulfil the requirements 
of X.509. I believe the intention was always to have sequence 
numbers.

Note that RFC2459 has changed the semantics of X.509  by using 
the phrase quote "allows users to easily determine when a 
particular CRL supersedes another CRL. " Clearly your randon 
scheme fulfils the requirement of 2459, but not of X.509. Was this 
semantic change intentional by the authors of 2459? Warwick, Tim, 
Dave, Russ?

As I see it, for aperiodic issuing of CRLs, the CRL number can be 
used to detect a missing CRL. For strict periodic issuing the time 
can be used instead of the CRL number.

David

> Ambarish Malpani Architect                                  
> 650.567.5457 ValiCert, Inc.                                 
> [email-masked] 339 N. Bernardo Ave.                         
> http://www.valicert.com Mountain View, CA 94043
> 
> 
> > Sent: Wednesday, August 09, 2000 7:59 PM To: [email-masked]
> > > If you don't use the CRLDP mechanism, you run the risk of having a
> > > bunch of applications misbehave with your CRLs.
> > 
> > > > Sent: Tuesday, August 08, 2000 8:13 PM To: [email-masked]
> > > >         In other words, the CRL number is monotonically
> > > >         increasing sequence number for each CA.
> > > > 
> > > > Could anyone advice me?
> > > > 
> > > > Thanks in advance.
> > > > 
> > > > -----
> > > > Naruhito TAKIGUCHI

***************************************************

David Chadwick
IS Institute, University of Salford, Salford M5 4WT
Tel +44 161 295 5351  Fax +44 161 745 8169
Mobile +44 790 167 0359
Email [email-masked]
Home Page  http://www.salford.ac.uk/its024/chadwick.htm
Understanding X.500  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string MLJ9-DU5T-HV8J

***************************************************