Subject: RE: delta CRLs

From: Santosh Chokhani <[email-masked]>
Date: Wed, 9 May 2001 22:58:49 -0400

Dr. Henson:

The rules for handling hold and release from hold are different when a delta
is applied to a base issued after the delta (I let you figure out the
rules).  But, if you have to know if the base was issued after the delta or
not, why apply the delta at all; just use the new base.

Thus if thisUpdate of base > = thisUpdate of delta, just use the base and do
not process the delta.

-----Original Message-----
From: Dr S N Henson [mailto:[email-masked]]
Sent: Wednesday, May 09, 2001 6:37 PM
To: [email-masked]
Subject: Re: delta CRLs

Peter Sylvester wrote:
> 
> 
> Is is necessary that the crlNumber of base URLs are strictly
> increasing? I am not convinced. The numbers are only used to
> create references to a chain of crls that can be used to create
> final 'virtual' base crl with an appropriate ThisUpdate.
> 

Well since you can combine any full CRL whose number is greater than or
equal to the base CRL number in the delta it has to be increasing.

If the full CRL has a number greater than the base CRL in the delta it
can still be combined but the delta CRL may contain some revocation data
already present in the base.

If the CRL number isn't strictly increasing then there's no way for the
CRL number of deltas to reference which full CRL the constructed CRL
represents.

This only applies if the only way to reference constructed and base CRLs
is the CRL number. If baseUpdateTime is used instead then it isn't
necessary except for the fact that some clients may not use
baseUpdateTime.

Steve.
-- 
Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
Personal Email: [email-masked] 
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the   OpenSSL project: http://www.openssl.org/
Business Email: [email-masked] PGP key: via homepage.