Subject: RE: delta CRLs

From: Peter Sylvester <[email-masked]>
Date: Wed, 9 May 2001 20:30:30 +0200 (MET DST)

Some thoughts

I think the examples on page 146 in annex c of the latest X509 draft 
seem to indicate that delta crls and full crls can have the same
number, and this is even necessary as drh pointed out. 

Either one can have a full crl with number n or one can construct it
by using the dCRL with the same number + the full crl indicated by
the BaseCRLNumber in the dcrl. 

The verifying party that tries to build the full CRL using a delta
has to create or get the baseCRL. It seems possible to me that in
case that the vp has a dCRL that has the value of BaseCRLNumber, the
process can be used recursively, this is the second model mentioned
in annex C.

Is is necessary that the crlNumber of base URLs are strictly
increasing? I am not convinced. The numbers are only used to
create references to a chain of crls that can be used to create 
final 'virtual' base crl with an appropriate ThisUpdate. 

If you take two base CRLs with the same crlNumber, where the
second is constructed in such a way that no data are removed then
a dCRl that refers to this number can use any of the two base CRLs
in order to construct a fresher base crl. 

And actually it seems to me that even monotonically increasing is
not really necessary since one has an order defined by thisUpdate.

---

From: Dr S N Henson <[email-masked]>
Date: Wed, 09 May 2001 23:36:43 +0100

> final 'virtual' base crl with an appropriate ThisUpdate.

Well since you can combine any full CRL whose number is greater than or
equal to the base CRL number in the delta it has to be increasing.

If the full CRL has a number greater than the base CRL in the delta it
can still be combined but the delta CRL may contain some revocation data
already present in the base.

If the CRL number isn't strictly increasing then there's no way for the
CRL number of deltas to reference which full CRL the constructed CRL
represents.

This only applies if the only way to reference constructed and base CRLs
is the CRL number. If baseUpdateTime is used instead then it isn't
necessary except for the fact that some clients may not use
baseUpdateTime.

Steve.
-- 
Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
Personal Email: [email-masked] 
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the   OpenSSL project: http://www.openssl.org/
Business Email: [email-masked] PGP key: via homepage.