Subject: RE: delta CRLs

From: Santosh Chokhani <[email-masked]>
Date: Mon, 7 May 2001 13:06:50 -0400

Russ:
 
What is stated below in your e-mail is INCORRECT.  I just spoke with David
Cooper.  He is going to make a posting again.  What I have said on this list
happens to be (by accident) correct.  And that is the base CRL and delta CRL
share the number from the same space and the number is monotonically
increasing.
 
We have added Stream Identifier feature to allow to differentiate (only if
the CA wishes) among indirect CRL, partitioned CRL etc.
 
Thus, a base and delta must have the same stream identifier in order to be
merged.  If the delta thisUpdate > base thisUpdate, delta CRL Number > base
CRL Number (for the same or no stream identifier).  This rule is invariant
except for number wrapping.

-----Original Message-----
From: Housley, Russ [mailto:[email-masked]]
Sent: Monday, May 07, 2001 12:00 PM
To: [email-masked]
Subject: RE: delta CRLs

I have updated the figure that David Cooper posted last week.  I think that
the update illustrates Trevor's point.  The full CRL and the delta CRL can
have two independent monotonically increasing sequence of integers and still
meet all of the PKIX and X.509-2000 requirements.

The numbering scheme that David proposed seems much easier to implement, but
I cannot find any text that the scheme below violates.

I do not know what to call the full CRL at 13:00 that is generated by
merging base CRL 1 and delta CRL 49...

Russ

= = = = = = = = = = 

current   revoked
time       certificates full CRL                        delta CRL
------------------------------------------------------------
12:00           {14}            cRLNumber = 1                   cRLNumber =
48
                                thisUpdate = 12:00              thisUpdate =
12:00
                                nextUpdate = 15:00              nextUpdate =
13:00
 
BaseCRLNumber = 1
                                CertificateList = {14}
CertificateList = {}

13:00           {14, 124}                                       cRLNumber =
49
                                                                thisUpdate =
13:00
                                                                nextUpdate =
14:00
 
BaseCRLNumber = 1
 
CertificateList = {124}

14:00           {14, 124}                                       cRLNumber =
50
                                                                thisUpdate =
14:00
                                                                nextUpdate =
15:00
 
BaseCRLNumber = 1
 
CertificateList = {124}

15:00           {14, 124, 39}   cRLNumber = 2                   cRLNumber =
51
                                thisUpdate = 15:00              thisUpdate =
15:00
                                nextUpdate = 18:00              nextUpdate =
16:00
 
BaseCRLNumber = 1
                                CertificateList = {14, 124, 39}
CertificateList = {124, 39}

16:00           {14, 124, 39,                                   cRLNumber =
52
                67}                                             thisUpdate =
16:00
                                                                nextUpdate =
17:00
 
BaseCRLNumber = 2
 
CertificateList = {67}

17:00           {14, 124, 39,                                   cRLNumber =
53
                67}                                             thisUpdate =
17:00
                                                                nextUpdate =
18:00
 
BaseCRLNumber = 2
 
CertificateList = {67}

18:00           {14, 124, 39,   cRLNumber = 3                   cRLNumber =
54
                67}             thisUpdate = 18:00              thisUpdate =
18:00
                                nextUpdate = 21:00              nextUpdate =
19:00
 
BaseCRLNumber = 2
                                CertificateList = {14, 124, 39,
CertificateList = {67}
                                                         21}

19:00           {14, 124, 39,                                   cRLNumber =
55
                67}                                             thisUpdate =
19:00
                                                                nextUpdate =
20:00
 
BaseCRLNumber = 3
 
CertificateList = {}