Subject: RE: delta CRLs

From: Peter Sylvester <[email-masked]>
Date: Fri, 11 May 2001 14:35:26 +0200 (MET DST)

> 	charset="iso-8859-1"
> 
> Dr. Henson:
> 
> The rules for handling hold and release from hold are different when a delta
> is applied to a base issued after the delta (I let you figure out the
> rules).  But, if you have to know if the base was issued after the delta or
> not, why apply the delta at all; just use the new base.
> 
> Thus if thisUpdate of base > = thisUpdate of delta, just use the base and do
> not process the delta.

This is obviously right. If you have a full CRL that is younger than a delta,
then one can just use the full, but the point made by drh was that
a delta can reference a base which is not necessarily the youngest full
crl that can be used, i.e. any base/full that is between the base indicated
in the dcrl and which is not younger that the dcrl can be used.

So one is in the situation of have a dcrl with a base reference, and some
full crl that may be a candidate for a dcrl update since the thisUpdate of
that file is older than that of the dCRL; What has to be ensured is that
this full crl is not older than the referenced base in order not to miss
information. And since the basereference is just a number, i.e. one
doesn't know the thisUpdate of the base, one can only use the 
crlnumber assuming that they are non-decreasing. 

> 
> -----Original Message-----
> From: Dr S N Henson [mailto:[email-masked]]
> Sent: Wednesday, May 09, 2001 6:37 PM
> To: [email-masked]
> Subject: Re: delta CRLs
> 
> 
> 
> 
> Peter Sylvester wrote:
> > 
> > 
> > Is is necessary that the crlNumber of base URLs are strictly
> > increasing? I am not convinced. The numbers are only used to
> > create references to a chain of crls that can be used to create
> > final 'virtual' base crl with an appropriate ThisUpdate.
> > 
> 
> Well since you can combine any full CRL whose number is greater than or
> equal to the base CRL number in the delta it has to be increasing.
> 
> If the full CRL has a number greater than the base CRL in the delta it
> can still be combined but the delta CRL may contain some revocation data
> already present in the base.
> 
> If the CRL number isn't strictly increasing then there's no way for the
> CRL number of deltas to reference which full CRL the constructed CRL
> represents.
> 
> This only applies if the only way to reference constructed and base CRLs
> is the CRL number. If baseUpdateTime is used instead then it isn't
> necessary except for the fact that some clients may not use
> baseUpdateTime.
> 
> Steve.
> -- 
> Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
> Personal Email: [email-masked] 
> Senior crypto engineer, Celo Communications: http://www.celocom.com/
> Core developer of the   OpenSSL project: http://www.openssl.org/
> Business Email: [email-masked] PGP key: via homepage.
> 
> ------_=_NextPart_001_01C0D8FD.23508960
> Content-Type: text/html;
> 	charset="iso-8859-1"
> Content-Transfer-Encoding: quoted-printable
> 
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
> <HTML>
> <HEAD>
> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
> charset=3Diso-8859-1">
> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
> 5.5.2652.35">
> <TITLE>RE: delta CRLs</TITLE>
> </HEAD>
> <BODY>
> 
> <P><FONT SIZE=3D2>Dr. Henson:</FONT>
> </P>
> 
> <P><FONT SIZE=3D2>The rules for handling hold and release from hold are =
> different when a delta is applied to a base issued after the delta (I =
> let you figure out the rules).&nbsp; But, if you have to know if the =
> base was issued after the delta or not, why apply the delta at all; =
> just use the new base.</FONT></P>
> 
> <P><FONT SIZE=3D2>Thus if thisUpdate of base &gt; =3D thisUpdate of =
> delta, just use the base and do not process the delta.</FONT>
> </P>
> 
> <P><FONT SIZE=3D2>-----Original Message-----</FONT>
> <BR><FONT SIZE=3D2>From: Dr S N Henson [<A =
> HREF=3D"mailto:[email-masked]">mailto:[email-masked]</A>]</FONT>
> <BR><FONT SIZE=3D2>Sent: Wednesday, May 09, 2001 6:37 PM</FONT>
> <BR><FONT SIZE=3D2>To: [email-masked]</FONT>
> <BR><FONT SIZE=3D2>Subject: Re: delta CRLs</FONT>
> </P>
> <BR>
> <BR>
> <BR>
> 
> <P><FONT SIZE=3D2>Peter Sylvester wrote:</FONT>
> <BR><FONT SIZE=3D2>&gt; </FONT>
> <BR><FONT SIZE=3D2>&gt; </FONT>
> <BR><FONT SIZE=3D2>&gt; Is is necessary that the crlNumber of base URLs =
> are strictly</FONT>
> <BR><FONT SIZE=3D2>&gt; increasing? I am not convinced. The numbers are =
> only used to</FONT>
> <BR><FONT SIZE=3D2>&gt; create references to a chain of crls that can =
> be used to create</FONT>
> <BR><FONT SIZE=3D2>&gt; final 'virtual' base crl with an appropriate =
> ThisUpdate.</FONT>
> <BR><FONT SIZE=3D2>&gt; </FONT>
> </P>
> 
> <P><FONT SIZE=3D2>Well since you can combine any full CRL whose number =
> is greater than or</FONT>
> <BR><FONT SIZE=3D2>equal to the base CRL number in the delta it has to =
> be increasing.</FONT>
> </P>
> 
> <P><FONT SIZE=3D2>If the full CRL has a number greater than the base =
> CRL in the delta it</FONT>
> <BR><FONT SIZE=3D2>can still be combined but the delta CRL may contain =
> some revocation data</FONT>
> <BR><FONT SIZE=3D2>already present in the base.</FONT>
> </P>
> 
> <P><FONT SIZE=3D2>If the CRL number isn't strictly increasing then =
> there's no way for the</FONT>
> <BR><FONT SIZE=3D2>CRL number of deltas to reference which full CRL the =
> constructed CRL</FONT>
> <BR><FONT SIZE=3D2>represents.</FONT>
> </P>
> 
> <P><FONT SIZE=3D2>This only applies if the only way to reference =
> constructed and base CRLs</FONT>
> <BR><FONT SIZE=3D2>is the CRL number. If baseUpdateTime is used instead =
> then it isn't</FONT>
> <BR><FONT SIZE=3D2>necessary except for the fact that some clients may =
> not use</FONT>
> <BR><FONT SIZE=3D2>baseUpdateTime.</FONT>
> </P>
> 
> <P><FONT SIZE=3D2>Steve.</FONT>
> <BR><FONT SIZE=3D2>-- </FONT>
> <BR><FONT SIZE=3D2>Dr Stephen N. Henson.&nbsp;&nbsp; <A =
> HREF=3D"http://www.drh-consultancy.demon.co.uk/" =
> TARGET=3D"_blank">http://www.drh-consultancy.demon.co.uk/</A></FONT>
> <BR><FONT SIZE=3D2>Personal Email: [email-masked] =
> </FONT>
> <BR><FONT SIZE=3D2>Senior crypto engineer, Celo Communications: <A =
> HREF=3D"http://www.celocom.com/" =
> TARGET=3D"_blank">http://www.celocom.com/</A></FONT>
> <BR><FONT SIZE=3D2>Core developer of the&nbsp;&nbsp; OpenSSL project: =
> <A HREF=3D"http://www.openssl.org/" =
> TARGET=3D"_blank">http://www.openssl.org/</A></FONT>
> <BR><FONT SIZE=3D2>Business Email: [email-masked] PGP key: via =
> homepage.</FONT>
> </P>
> 
> </BODY>
> </HTML>
> ------_=_NextPart_001_01C0D8FD.23508960--
>