Subject: RE: delta CRLs

From: "David A. Cooper" <[email-masked]>
Date: Mon, 07 May 2001 15:43:27 -0400

Trevor,

PKIX states that the CRL referenced as the base CRL must have been issued as a full CRL. One could always use the most recently issued full CRL as the base CRL, but this is not required. In my paper on delta-CRLs (http://csrc.nist.gov/pki/documents/sliding_window.pdf), I argue that a scheme that does not use the most recently issued full CRL as the base is more efficient.

So, a CRL issuer can safely switch the base that it uses whenever it issues a full CRL. However, to be efficient, one should take into account the usage patterns of the relying parties to determine which base should be used for a delta. Since such usage patterns are a local matter, we should leave it to local policy to determine the relationship between full CRLs and delta-CRLs.

Tim Polk has suggested writing a short informational RFC about delta-CRLs. This document could include some sample delta-CRL issuing scenarios that would help to clarify the connections between base CRLs and delta-CRLs.

Dave

At 11:45 AM 5/7/01 -0700, Trevor Freeman wrote:
>I Guess I need to clarify my question a little.
>I accept that the standard is clear that the remove from CRL must apply
>as long as the referenced base had the revocation entry. What is not
>clear is when can a CA switch the base no it uses with the delta CRL
>safely. Now you could leave that to local policy - which is to say we
>give no guidance, or we can clarify a rule at which time a CA must
>discontinue use of a base CRL.