Subject: RE: Two questions on delta-CRL

From: Ambarish Malpani <[email-masked]>
Date: Tue, 02 Jan 2001 18:04:57 -0800

I, too, would like to see the requirement relaxed to a full CRL
SHOULD be published when a delta CRL is issued.

If I remember correctly, this was discussed on the list. I believe
PKIX has it because X.509 had it. Also, in the past, the discussion
indicated that a CA might publish a new full CRL and then send it
to /dev/null, so the full CRL was only published in principal.

It would be good to get a definitive answer to how real the
requirement for the full CRL is.

Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
339 N. Bernardo Ave.                          http://www.valicert.com
Mountain View, CA 94043

> -----Original Message-----
> From: Denis Pinkas [mailto:[email-masked]]
> Sent: Tuesday, January 02, 2001 6:37 AM
> To: Sam Schaen
> Cc: IETF-PXIX
> Subject: Re: Two questions on delta-CRL
> 
> 
> Sam,
> 
> Thanks for attempting to answer the question. One possible 
> answer would be
> to prevent people using delta-CRLs to get an advantage over 
> people using
> regular CRLs. The text used to write RFC 2459 was written at 
> a time where
> OCSP servers did not existed. However, clients now using OCSP 
> servers may
> get such an advantage, i.e. fresher information about 
> revocation status. 
> 
> Would the following scenario (currently forbidden by RFC 
> 2459) makes sense ?
> 
> The full CRL is issued every day, and a delta CRL is issued 
> every hour. 
> 
> I was wondering whether it would be possible to relax this 
> rule, and thus
> have e.g.:
> 
> When a delta-CRL is issued, the CAs SHOULD also issue a complete CRL.
> 
> However, before doing so, we must understand the original 
> rational and all
> the implications. To understand the original rational I would expect a
> response from one of the authors of RFC 2459. However, for 
> the second part
> of the question (i.e. all the implications) the discussion is open.
> 
> Denis
> 
>  
> > I believe the requirement for issuing a complete CRL when a 
> delta CRL is
> > released makes sense.  It permits applications that don't 
> understand delta
> > CRLs to obtain the most recent information.  Overall 
> network bandwidth usage
> > is still reduced to the extent that other delta-CRL-capable 
> applications do
> > make use of the delta CRL rather than retrieving a full CRL.  The
> > availability of a current full CRL also allows an application to
> > resynchronize at any point.
> > 
> > Denis Pinkas wrote:
> > 
> > > In section 5.2.4 (Delta CRL Indicator), RFC 2459 states:
> > >
> > >   The delta CRL indicator is a critical CRL extension 
> that identifies a
> > >   delta-CRL.  The use of delta-CRLs can significantly improve
> > >   processing time for applications which store revocation 
> information
> > >   in a format other than the CRL structure.  This allows 
> changes to be
> > >   added to the local database while ignoring unchanged 
> information that
> > >   is already in the local database.
> > >
> > >   When a delta-CRL is issued, the CAs MUST also issue a 
> complete CRL.
> > >
> > >   (...) Again, a delta-CRL MUST NOT be issued without a 
> corresponding
> > >   complete CRL.
> > >
> > > The two questions are the following:
> > >
> > > 1) What is the rational for mandating the issuance of a 
> complete CRL each
> > > time a delta-CRL is issued ?
> > > 2) Under which conditions could this requirement be relaxed ?
> > >
> > > Denis
>

---

From: Rich Salz <[email-masked]>
Date: Tue, 02 Jan 2001 22:40:57 -0500

> SHOULD be published when a delta CRL is issued.

This would essentially force everyone to understand deltaCRL's.

I do not think the world is ready for that yet.
	/r$

---

From: Michael Ströder <[email-masked]>
Date: Thu, 11 Jan 2001 18:45:03 +0100

> SHOULD be published when a delta CRL is issued.

Why?

Ciao, Michael.