Subject: RE: delta CRLs

From: Santosh Chokhani <[email-masked]>
Date: Mon, 7 May 2001 18:40:16 -0400

Trevor:

A CA does not use a CRL.  CRL is used by relying party.  A CA can publish
the base based on its policy, e.g., nextUpdate.

All we are saying is that when the delta that says removeFrom CRL is issued,
any base issued at that time or after that time need not have the
certificateHold entry.

-----Original Message-----
From: Trevor Freeman [mailto:[email-masked]]
Sent: Monday, May 07, 2001 2:45 PM
To: David A. Cooper; [email-masked]
Subject: RE: delta CRLs

I Guess I need to clarify my question a little.
I accept that the standard is clear that the remove from CRL must apply
as long as the referenced base had the revocation entry. What is not
clear is when can a CA switch the base no it uses with the delta CRL
safely. Now you could leave that to local policy - which is to say we
give no guidance, or we can clarify a rule at which time a CA must
discontinue use of a base CRL. 

-----Original Message-----
From: David A. Cooper [mailto:[email-masked]] 
Sent: Monday, May 07, 2001 10:57 AM
To: [email-masked]
Subject: RE: delta CRLs

At 04:00 PM 5/4/01 -0700, Trevor Freeman wrote:
>To clarify point three, the delta CRL must include "remove from"
entries
>until the nextupdate time in the referenced base. A CA does not know if
>clients have picked up the base or knot, and to assume they have would
>introduce an error.

Trevor,

new-part1-06 is very clear on when removeFromCRL must appear on a
delta-CRL. A delta-CRL must state "removeFromCRL" for a certificate as
long as the base CRL referenced by the delta was issued before the hold
was removed. The nextUpdate time in the referenced base is irrelevant.
The reason is that there is no requirement that a delta-CRL be applied
to the most recently issued base CRL. Any full CRL whose cRLNumber is
greater than or equal to the BaseCRLNumber specified in the delta-CRL
can be used. The relevant text from new-part1-06 is as follows:

   If a CA supports the certificateHold revocation reason the following
rules must be applied when generating delta CRLs:

         (a) If a certificate was listed as revoked with revocation
reason
         certificateHold on a CRL (either a delta CRL or a CRL that is
         complete for a given scope), whose cRLNumber is n, and the hold
is
         subsequently released, the certificate must be included in all
         delta CRLs issued after the hold is released where the
cRLNumber
         of the referenced base CRL is less than or equal to n. The
         certificate must be listed with revocation reason removeFromCRL
         unless the certificate is subsequently revoked again for one of
         the revocation reasons covered by the delta CRL, in which case
the
         certificate must be listed with the revocation reason
appropriate
         for the subsequent revocation.

         (b) If the certificate was not removed from hold, but was
         permanently revoked, then it must be listed on all subsequent
         delta CRLs where the cRLNumber of the referenced base CRL is
less
         than the cRLNumber of the CRL (either a delta CRL or a CRL that
is
         complete for the given scope) on which the permanent revocation
         notice first appeared.