Subject: RE: delta CRLs

From: Santosh Chokhani <[email-masked]>
Date: Fri, 4 May 2001 16:43:21 -0400

Russ:
 
In lieu of 2, you can also compare thisUpdate field of the base and delta
and make sure that a delta is applied to only an earlier (and not the same
time issued or later issued base).
 
I did not understand from your message, which of the three rules was not
clear to you.  Or may be you meant the PKIX RFC is not clear on the three
rules.
 
-----Original Message-----
From: Housley, Russ [mailto:[email-masked]]
Sent: Friday, May 04, 2001 4:32 PM
To: Santosh Chokhani
Cc: [email-masked]
Subject: RE: delta CRLs

Santosh:

I see your point.

There are three rules that interact to make it all work, and I think that we
are only clear about two of the rules.

1.  The base CRL referenced by the delta CRL MUST be less than or equal to
the base CRL to which the updates will be applied.

2.  The CRL number in the delta CRL MUST be greater than or equal to the CRL
number of the base (otherwise the entries are already accommodated by the
base).

3.  Delta CRLs MUST continue to include removeFromCRL entries even if they
are not otherwise needed to update the referenced base.  David's posting
provided the rules to describe when they are not longer necessary.

Russ