Subject: RE: Two questions on delta-CRL

From: David Cross <[email-masked]>
Date: Tue, 2 Jan 2001 19:41:47 -0800

I have to disagree.  Everyone should continue to publish base CRLs as often
as they do today.  If you have the capability and clients that understand
delta CRLs, then you can take advantage of the technology and publish delta
CRLs much more frequently.

Even if a base CRL were published every time a delta CRL was published, many
clients will not retrieve a new base because many clients cache a base CRL
locally until it expires.  The benefit goes away and the issues with
frequent publication of a base CRL increase.   

David B. Cross

-----Original Message-----
From: Rich Salz [mailto:[email-masked]]
Sent: Tuesday, January 02, 2001 7:41 PM
To: Ambarish Malpani
Cc: IETF-PXIX
Subject: Re: Two questions on delta-CRL

> I, too, would like to see the requirement relaxed to a full CRL SHOULD 
> be published when a delta CRL is issued.

This would essentially force everyone to understand deltaCRL's.

I do not think the world is ready for that yet.
	/r$

---

From: hansen wang <[email-masked]>
Date: Tue, 2 Jan 2001 20:00:34 -0800 (PST)

> CRLs much more frequently.

Agree.
Seems to me that some are mistaking "publishing" for "need to download".
When the CA issues both a Base CRL and a Delta CRL, the clients have an
option _at_all_times_ to download either:

1. the current Base if they cannot handle Deltas or if the Base
   (or Full) CRL that they're holding cannot be updated by the current
   Delta CRL because it is too old,
2. the current Delta if the Base (or Full) CRL that they're hold _CAN_
   be updated by the current Delta CRL.

There's no need for each client to download both just because they're
published. Both can bring the client upto the Current CRL. 

> frequent publication of a base CRL increase.   

Agree here too. Most clients can make use of the Delta but there will
always be some small percentage of clients that will have to suffer the
penalty of needing to download a Base CRL for reason listed above. 
Publishing both a Current Base and Delta CRL does not require an
out-of-date client to have to download both an older Base CRL and an
additional Current Delta CRL to bring it up to the Current Full CRL.
Optionally, the Delta CRL may also include the hash signature of the
Current Full CRL to use as an integrity check to see that it has an exact
copy of the Current Full CRL that was published by the CA.

--
***************************************************************
Hansen Wang                         Office: CICSR381
M.A.Sc Candidate                    Room:   MCLD 458/CICSR388
Communications Group                Tel:    (604)822-4985 (Lab)
ECE, UBC                                    (604)822-5084 (Lab)
2356 Main Mall                      Fax:    (604)822-5949
Vancouver, BC                       email:  [email-masked]
V6T 1Z4
*************  http://www.ee.ubc.ca/~hansenw  *****************