Subject: RE: delta CRLs

From: "Housley, Russ" <[email-masked]>
Date: Fri, 04 May 2001 17:30:56 -0400

Santosh:

You are correct, there are two equivalent checks for rule 2.

I do not think that the proposed text makes all three rules 
clear.  Obviously, this thread will lead to better text.

Russ

At 04:43 PM 5/4/2001 -0400, Santosh Chokhani wrote:
>Russ:
>
>In lieu of 2, you can also compare thisUpdate field of the base and delta 
>and make sure that a delta is applied to only an earlier (and not the same 
>time issued or later issued base).
>
>I did not understand from your message, which of the three rules was not 
>clear to you.  Or may be you meant the PKIX RFC is not clear on the three 
>rules.
>
>-----Original Message-----
>From: Housley, Russ [mailto:[email-masked]]
>Sent: Friday, May 04, 2001 4:32 PM
>To: Santosh Chokhani
>Cc: [email-masked]
>Subject: RE: delta CRLs
>
>Santosh:
>
>I see your point.
>
>There are three rules that interact to make it all work, and I think that 
>we are only clear about two of the rules.
>
>1.  The base CRL referenced by the delta CRL MUST be less than or equal to 
>the base CRL to which the updates will be applied.
>
>2.  The CRL number in the delta CRL MUST be greater than or equal to the 
>CRL number of the base (otherwise the entries are already accommodated by 
>the base).
>
>3.  Delta CRLs MUST continue to include removeFromCRL entries even if they 
>are not otherwise needed to update the referenced base.  David's posting 
>provided the rules to describe when they are not longer necessary.
>
>Russ