Subject: RE: delta CRLs

From: "Housley, Russ" <[email-masked]>
Date: Mon, 07 May 2001 11:59:58 -0400

I have updated the figure that David Cooper posted last week.  I
think that the update illustrates Trevor's point.  The full CRL and
the delta CRL can have two independent monotonically increasing sequence
of integers and still meet all of the PKIX and X.509-2000
requirements.

The numbering scheme that David proposed seems much easier to implement,
but I cannot find any text that the scheme below violates.

I do not know what to call the full CRL at 13:00 that is generated by
merging base CRL 1 and delta CRL 49...

Russ

= = = = = = = = = =

current   revoked

time
certificates full
CRL                        delta
CRL

------------------------------------------------------------

12:00           {14}            cRLNumber
=
1                   cRLNumber
= 48

thisUpdate
=
12:00              thisUpdate
= 12:00

nextUpdate
=
15:00              nextUpdate
= 13:00

BaseCRLNumber
= 1

CertificateList
=
{14}          CertificateList
= {}

13:00           {14,
124}                                       cRLNumber
= 49

thisUpdate
= 13:00

nextUpdate
= 14:00

BaseCRLNumber
= 1

CertificateList
= {124}

14:00           {14,
124}                                       cRLNumber
= 50

thisUpdate
= 14:00

nextUpdate
= 15:00

BaseCRLNumber
= 1

CertificateList
= {124}

15:00           {14,
124, 39}   cRLNumber =
2                   cRLNumber
= 51

thisUpdate
=
15:00              thisUpdate
= 15:00

nextUpdate
=
18:00              nextUpdate
= 16:00

BaseCRLNumber
= 1

CertificateList
= {14, 124, 39} CertificateList = {124, 39}

16:00           {14,
124,
39,                                   cRLNumber
= 52

67}                                             thisUpdate
= 16:00

nextUpdate
= 17:00

BaseCRLNumber
= 2

CertificateList
= {67}

17:00           {14,
124,
39,                                   cRLNumber
= 53

67}                                             thisUpdate
= 17:00

nextUpdate
= 18:00

BaseCRLNumber
= 2

CertificateList
= {67}

18:00           {14,
124, 39,   cRLNumber =
3                   cRLNumber
= 54

67}             thisUpdate
=
18:00              thisUpdate
= 18:00

nextUpdate
=
21:00              nextUpdate
= 19:00

BaseCRLNumber
= 2

CertificateList
= {14, 124, 39, CertificateList = {67}

21}

19:00           {14,
124,
39,                                   cRLNumber
= 55

67}                                             thisUpdate
= 19:00

nextUpdate
= 20:00

BaseCRLNumber
= 3

CertificateList
= {}