Subject: RE: delta CRLs

From: Santosh Chokhani <[email-masked]>
Date: Thu, 3 May 2001 12:49:48 -0400

Please see comments in-line.

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]]
Sent: Thursday, May 03, 2001 10:49 AM
To: Santosh Chokhani
Cc: Housley, Russ; [email-masked]
Subject: Re: delta CRLs

Santosh,

Mails are crossing around, and are not necessarilly received in the same
order. :-)

You indicated "Also a minor technical change to your other sentence" in your
response to Russ:

 "An application can construct an updated CRL by retrieving the appropriate
 base CRL for that scope, and combining it with a delta CRL which contains
 a delta CRL indicator extension with the same CRL number or lower number
 as the base CRL."

What is a "delta CRL which contains a delta CRL indicator extension with
(...) lower number as the base CRL." If you pick this delta CRL then it is
missing some of the information. Unless you speak of the time T and compare
it with thisUpdate and nextUpdate this does not work.

[Santosh says: Denis, the language is a bit awkward.  Let us take an
example, a delta is issued reference base 20, i.e., delta CRL indicator =
20.  Now, let us say base 21 and 22 are also issued prior to delta.  You may
be able to use any one of the three bases: 20, 21, and 22 in conjunction
with the delta to create a "current" revocation picture at the relying
party.]

You also said: " Please note that the delta CRL can always be applied to a
higher base than the one referenced in the delta CRL extension."

You now say "higher" in that sentence. This is even more confusing.

[Santosh Says: That is because in one case I am saying that you can use any
base with a delta referencing lower base.  In the other case I am saying
that a delta or referenced or higher base together can be used.  I WANTED TO
MAKE LEAST AMOUNT TO CHANGES TO RUSS'S ORIGINAL SENTENCE.]

Please take note that the intent is to describe what is necessary to support
the "traditional scheme" and I got the feeling that you would like this
sentence to support a different scheme. On April 19, David Cooper provided
some explanations making some confusing between the numering of delta-CRLs
and the numbering of base CRLs. Thay have no relationships besides that the
numbers should always increase.

If I just re-use the text from David, then you get the effect he wanted
without the need to take advantage of any new sequential numbering. Here is
the corrected text:

" Suppose that delta-CRLs are issued once an hour. For example, suppose that
a base CRL, CRL number 5, was issued at midnight and that every hour for the
next 24 hours, delta-CRLs were issued with a BaseCRLNumber of 5. If a
relying party performs its first validation at 3:10am, it would the base CRL
issued at midnight and the delta-CRL issued at 3:00am (e.g. CRL number 28).
It would combine these to construct the freshest CRL.

A few hours later, at 6:30am, the relying party performs another validation.
The relying party has, in its local cache, the CRL which it constructed at
3:10am. It wants to update the information in its local case to based on the
newly available revocation information. So, it obtains the latest delta-CRL.
This delta-CRL has a CRL number of 42 and a BaseCRLnumber of 5. Since
it has a BaseCRLNumber of 5, the delta-CRL provides status information for
all certificates whose status has changed since CRL number 5 was issued
(midnight). So, clearly the delta-CRL provides status information for all
certificates whose status has changed since 3:00am when CRL number 28 was
issued. Thus, the relying party can combine the delta-CRL with its locally
cached version of the CRL which it constructed at 3:10am to obtain the
freshest CRL."

So the addition you were proposing is not adequate. If we were going to
support variations beyond the traditional scheme, this should be in a
separate sentence.

Regards,

Denis