Subject: RE: delta CRLs

From: "David A. Cooper" <[email-masked]>
Date: Mon, 07 May 2001 13:25:54 -0400

Russ, Trevor,

The CRL numbers of full CRLs and delta-CRLs are not independent. The only differences between a full CRL and a delta-CRL are the inclusion or exclusion of the deltaCRLIndicator extension and the contents of revokedCertificates. Otherwise, there should be no difference between a delta-CRL and a full CRL issued for the same scope. The cRLNumber for a delta-CRL should be the same as the cRLNumber that would have been assigned to a full CRL issued at the same time. In fact, new-part1-06 states:

         When a conforming CA issues a delta CRL, the CA MUST also issue a CRL
         that is complete for the given scope.  Both the delta CRL and the
         complete CRL MUST include the CRL number extension (see sec. 5.2.3).
         The CRL number extension in the delta CRL and the complete CRL MUST
         contain the same value.  When a delta CRL is issued, it MUST cover
         the same set of reasons and same set of certificates that were
         covered by the base CRL it references.

The text explicitly states that when a delta-CRL and full CRL are issued at the same time, the CRL numbers of both CRLs MUST be the same. The text also states that a locally constructed CRL takes on the CRL number of the delta-CRL used in its construction and that this constructed CRL may be used in place of an issued CRL :

         An application can construct a CRL that is complete for a given
         scope, at the current time, in either of the following ways:

                 (a) by retrieving the current delta CRL for that scope, and
                 combining it with an issued CRL that is complete for that scope
                 and that has a cRLNumber greater than or equal to the cRLNumber of
                 the base CRL referenced in the delta CRL; or

                 (b) by retrieving the current delta CRL for that scope and
                 combining it with a locally constructed CRL whose cRLNumber is
                 greater than or equal to the cRLNumber of the base CRL referenced
                 in the current delta CRL.

         The constructed CRL has the CRL number specified in the CRL number
         extension found in the delta CRL used in its construction.

If the CRL number of the delta-CRLs and full CRLs were independent, one could not apply a delta-CRL to a locally constructed CRL as is described in (b) above. Perhaps the requirement to coordinate CRL numbers between full and delta-CRLs is not as clear now that the requirement to issue a full CRL with every delta has been deleted. If that is the case, then some text should be added to make sure that this point is clear.

Dave

At 11:59 AM 5/7/01 -0400, Housley, Russ wrote:
>I have updated the figure that David Cooper posted last week.  I think that the update illustrates Trevor's point.  The full CRL and the delta CRL can have two independent monotonically increasing sequence of integers and still meet all of the PKIX and X.509-2000 requirements.