Subject: Two questions on delta-CRL

From: Denis Pinkas <[email-masked]>
Date: Tue, 02 Jan 2001 12:24:43 +0100

In section 5.2.4 (Delta CRL Indicator), RFC 2459 states:

  The delta CRL indicator is a critical CRL extension that identifies a
  delta-CRL.  The use of delta-CRLs can significantly improve
  processing time for applications which store revocation information
  in a format other than the CRL structure.  This allows changes to be
  added to the local database while ignoring unchanged information that
  is already in the local database.

  When a delta-CRL is issued, the CAs MUST also issue a complete CRL.

  (...) Again, a delta-CRL MUST NOT be issued without a corresponding 
  complete CRL. 

The two questions are the following: 

1) What is the rational for mandating the issuance of a complete CRL each
time a delta-CRL is issued ?
2) Under which conditions could this requirement be relaxed ?

Denis

---

From: Sam Schaen <[email-masked]>
Date: Tue, 02 Jan 2001 09:16:47 -0500

I believe the requirement for issuing a complete CRL when a delta CRL is
released makes sense.  It permits applications that don't understand delta
CRLs to obtain the most recent information.  Overall network bandwidth usage
is still reduced to the extent that other delta-CRL-capable applications do
make use of the delta CRL rather than retrieving a full CRL.  The
availability of a current full CRL also allows an application to
resynchronize at any point.

---

From: Denis Pinkas <[email-masked]>
Date: Tue, 02 Jan 2001 15:36:31 +0100

Sam,

Thanks for attempting to answer the question. One possible answer would be
to prevent people using delta-CRLs to get an advantage over people using
regular CRLs. The text used to write RFC 2459 was written at a time where
OCSP servers did not existed. However, clients now using OCSP servers may
get such an advantage, i.e. fresher information about revocation status. 

Would the following scenario (currently forbidden by RFC 2459) makes sense ?

The full CRL is issued every day, and a delta CRL is issued every hour. 

I was wondering whether it would be possible to relax this rule, and thus
have e.g.:

When a delta-CRL is issued, the CAs SHOULD also issue a complete CRL.

However, before doing so, we must understand the original rational and all
the implications. To understand the original rational I would expect a
response from one of the authors of RFC 2459. However, for the second part
of the question (i.e. all the implications) the discussion is open.

Denis

---

From: Michael Ströder <[email-masked]>
Date: Thu, 11 Jan 2001 18:54:53 +0100

Sam Schaen wrote:
> released makes sense.
> [..]
> The availability of a current full CRL also allows an application to

I think this is the most important argument. An application might
loose the stored CRL or the CRL got corrupt by e.g. a system crash.
The damage for the application is limited to the loss of some
network-bandwidth. Resynchronization is simple.

E.g. if you issue a full CRL each day (24h) and delta-CRLs every
hour the application will have to obtain the last full CRL and every
delta CRL issued since then to get up to date (max. 24 accesses
instead of one).

If you want to relax the requirement of issuing full and delta CRLs
at the same time you have to mandate
1. that the CRL issuer stores all delta URLs from the last full CRL
and
2. you have to provide appropriate service access points to obtain
all necessary delta CRLs.

The application logic gets more complicated though.

Ciao, Michael.

---

From: "David A. Cooper" <[email-masked]>
Date: Thu, 11 Jan 2001 13:10:49 -0500

Michael,

This is not correct. A delta CRL must (at least) provide information about every certificate whose status has changed since the previous full CRL was issued. Thus, one can always get up to date by obtaining the most recently issued full CRL and the most recently issued delta CRL (max. 2 accesses).

To put it another way, each delta CRL must specify a baseCRLNumber and must list every certificate whose status has changed since the CRL whose cRLNumber is baseCRLNumber was issued. Since the CRL whose cRLNumber is baseCRLNumber must have been issued as a full CRL, it is always sufficient to apply this one delta CRL to its corresponding base CRL to obtain up to date information.

Dave