Subject: RE: delta CRLs

From: "David A. Cooper" <[email-masked]>
Date: Mon, 07 May 2001 13:57:22 -0400

At 04:00 PM 5/4/01 -0700, Trevor Freeman wrote:
>To clarify point three, the delta CRL must include "remove from" entries
>until the nextupdate time in the referenced base. A CA does not know if
>clients have picked up the base or knot, and to assume they have would
>introduce an error.

Trevor,

new-part1-06 is very clear on when removeFromCRL must appear on a delta-CRL. A delta-CRL must state "removeFromCRL" for a certificate as long as the base CRL referenced by the delta was issued before the hold was removed. The nextUpdate time in the referenced base is irrelevant. The reason is that there is no requirement that a delta-CRL be applied to the most recently issued base CRL. Any full CRL whose cRLNumber is greater than or equal to the BaseCRLNumber specified in the delta-CRL can be used. The relevant text from new-part1-06 is as follows:

   If a CA supports the certificateHold revocation reason the following rules must be applied when generating delta CRLs:

         (a) If a certificate was listed as revoked with revocation reason
         certificateHold on a CRL (either a delta CRL or a CRL that is
         complete for a given scope), whose cRLNumber is n, and the hold is
         subsequently released, the certificate must be included in all
         delta CRLs issued after the hold is released where the cRLNumber
         of the referenced base CRL is less than or equal to n. The
         certificate must be listed with revocation reason removeFromCRL
         unless the certificate is subsequently revoked again for one of
         the revocation reasons covered by the delta CRL, in which case the
         certificate must be listed with the revocation reason appropriate
         for the subsequent revocation.

         (b) If the certificate was not removed from hold, but was
         permanently revoked, then it must be listed on all subsequent
         delta CRLs where the cRLNumber of the referenced base CRL is less
         than the cRLNumber of the CRL (either a delta CRL or a CRL that is
         complete for the given scope) on which the permanent revocation
         notice first appeared.