Subject: RE: delta CRLs

From: Santosh Chokhani <[email-masked]>
Date: Mon, 7 May 2001 13:09:05 -0400

Tim and Russ:

The base and delta share the SAME NUMBER SPACE.  Your example is like a work
of art that is not REALIZABLE in real word.

-----Original Message-----
From: Tim Polk [mailto:[email-masked]]
Sent: Monday, May 07, 2001 1:06 PM
To: Housley, Russ; [email-masked]
Subject: RE: delta CRLs

Russ,

At 11:59 AM 5/7/01 -0400, you wrote:
>I have updated the figure that David Cooper posted last week.  I think 
>that the update illustrates Trevor's point.  The full CRL and the delta 
>CRL can have two independent monotonically increasing sequence of integers 
>and still meet all of the PKIX and X.509-2000 requirements.

I expect you are correct; the description of CRL numbering currently in 
PKIX may permit this scheme.  However, I think we should tighten the
wording.

>The numbering scheme that David proposed seems much easier to implement, 
>but I cannot find any text that the scheme below violates.
>
>I do not know what to call the full CRL at 13:00 that is generated by 
>merging base CRL 1 and delta CRL 49...

I believe that is the problem with Trevor's proposal.  The CRL number of 
the constructed CRL does not help you determine whether or not a future 
delta can be applied safely to the constructed CRL.

The most glaring example of this is the delta CRL number 51.  When it is 
combined with full CRL number 1, you actually obtain full CRL number 
2.  However, at 16:00 the CA issues delta 52, which points to full CRL 2 as 
a base.  Using Trevor's numbering scheme, there is no way to be sure that 
CRL 1 and delta 51 are the same CRL as the full CRL with CRL number 2.  As 
a result, at 16:00 the relying party must download both full CRL number 2 
and delta number 52.

That is the sort of behavior we want to avoid.

Tim

>Russ
>
>
>= = = = = = = = = =
>
>
>current   revoked
>time       certificates full CRL                        delta CRL
>------------------------------------------------------------
>12:00           {14}            cRLNumber = 1                   cRLNumber =
48
>                                 thisUpdate = 
> 12:00              thisUpdate = 12:00
>                                 nextUpdate = 
> 15:00              nextUpdate = 13:00
> 
>BaseCRLNumber = 1
>                                 CertificateList = 
> {14}          CertificateList = {}
>
>
>13:00           {14, 124}                                       cRLNumber =
49
> 
>thisUpdate = 13:00
> 
>nextUpdate = 14:00
> 
>BaseCRLNumber = 1
> 
>CertificateList = {124}
>
>
>14:00           {14, 124}                                       cRLNumber =
50
> 
>thisUpdate = 14:00
> 
>nextUpdate = 15:00
> 
>BaseCRLNumber = 1
> 
>CertificateList = {124}
>
>
>15:00           {14, 124, 39}   cRLNumber = 2                   cRLNumber =
51
>                                 thisUpdate = 
> 15:00              thisUpdate = 15:00
>                                 nextUpdate = 
> 18:00              nextUpdate = 16:00
> 
>BaseCRLNumber = 1
>                                 CertificateList = {14, 124, 39} 
> CertificateList = {124, 39}
>
>
>16:00           {14, 124, 39,                                   cRLNumber =
52
>                 67} 
> thisUpdate = 16:00
> 
>nextUpdate = 17:00
> 
>BaseCRLNumber = 2
> 
>CertificateList = {67}
>
>
>17:00           {14, 124, 39,                                   cRLNumber =
53
>                 67} 
> thisUpdate = 17:00
> 
>nextUpdate = 18:00
> 
>BaseCRLNumber = 2
> 
>CertificateList = {67}
>
>
>18:00           {14, 124, 39,   cRLNumber = 3                   cRLNumber =
54
>                 67}             thisUpdate = 
> 18:00              thisUpdate = 18:00
>                                 nextUpdate = 
> 21:00              nextUpdate = 19:00
> 
>BaseCRLNumber = 2
>                                 CertificateList = {14, 124, 39, 
> CertificateList = {67}
>                                                          21}
>
>
>19:00           {14, 124, 39,                                   cRLNumber =
55
>                 67} 
> thisUpdate = 19:00
>nextUpdate = 20:00
>BaseCRLNumber = 3
>CertificateList = {}