Subject: RE: delta CRLs

From: Santosh Chokhani <[email-masked]>
Date: Thu, 3 May 2001 17:29:52 -0400

Russ:

Please comments in-line

>Russ: Please note minor word smithing for grammar and for technical 
>accuracy.  The sentences should read as follows.
>
>"A delta CRL provides an update to a previously issued complete CRL.  A 
>delta CRL only includes entries for certificates that have changed status 
>since the complete CRL referenced in the delta CRL extension was issued."

No problem.

[Santosh Says: Per other e-mails, also replace "complete" with "base")

>Also a minor technical change to your other sentence:
>
>"An application can construct an updated CRL by retrieving the appropriate 
>base CRL for that scope, and combining it with a delta CRL which contains 
>a delta CRL indicator extension with the same CRL number or lower number 
>as the base CRL."

The most recent X.509 says:

    the combination of a CRL containing the delta CRL indicator extension
    plus the CRL referenced in the BaseCRLNumber component of this
    extension is equivalent to a full CRL, for the applicable scope, at the
    time of publication of the dCRL.

So, the appropriate thing to do seems to be dropping the phrase:

    An application can construct an updated CRL by combining a base CRL and
    a delta CRL which contains a delta CRL indicator extension with the same
    CRL number as the base CRL.

>Please note that the delta CRL can always be applied to a higher base than 
>the one referenced in the delta CRL extension.

This will result in collisions.  The later CRL and delta CRL may both 
contain the same additions.  However, with on-hold, a certificate that was 
removeFromCRL could be put back on hold.

[Santosh Says: The collisions are not a problem.  You may need to apply a
later CRL because other bases may have been issued and the referenced base
may have been deleted from the directory.  The basic approach is to apply a
delta to a base only of the delta is issued to a base whose thisUpdate is
prior to thisUpdate field of the delta.  Thus, what you are suggesting
regarding hold can never occur.  All of these rules are spelled out in Annex
B of the X.509]

>I also agree with Russ that PKIX need not include the "hold" feature.

Cool.

Russ