Subject: RE: delta CRLs

From: "Trevor Freeman" <[email-masked]>
Date: Sun, 6 May 2001 22:34:56 -0700

Santosh,
I agree that the Delta CRL indicator extension which identifies the CRL
as a delta CRL, contains a number, and that number refers to the CRL
Number extension in the base CRL, and the client must have a base CRL
which contains a CRL number equal to or grater than the number in the
Delta CRL indicator.
That is not what I am taking about. 
The way I read Russ's rule 2 is that he inferring a relationship between
the CRL number extension in the delta CRL and the CRL number extension
in the base. I am pointing out that there is no relationship between
these two numbers. 
THE point I am trying to clarify in rule three is how long to persist
the "remove from CRL" entry in the delta. We have a rule when to purge
expired revoked certificates from a full CRLs. What we need is an
equally precise rule when to purge remove from CRL entries from a base
CRL.
Trevor
 
-----Original Message-----
From: Santosh Chokhani [mailto:[email-masked]] 
Sent: Saturday, May 05, 2001 4:58 AM
To: Trevor Freeman; Housley, Russ; Santosh Chokhani
Cc: [email-masked]
Subject: RE: delta CRLs
 
Trevor: 
The 2000 version of X.509 is very clear on this.  For a given CRL stream
identifier, the CRL number is unique whether it is base or delta.  That
is why delta number has to be greater than the base.
However, since the CRL number is not a mandatory extension (although
PKIX profile requires it), a check based on thisUpdate is more general
and preferred.
As for rule 3, I did not mention it, but this is a CRL generation rule
and applicable to the CA, where as first two rules are CRL processing
rule and hence applicable to relying parties.  I hope the revision will
put these rules in different places for processing and generation.
The processing rule should be that if the removeFromCRL is on delta,
then the entry (if present in the base) should be deleted.
-----Original Message----- 
From: Trevor Freeman [mailto:[email-masked]
<mailto:[email-masked]> ] 
Sent: Friday, May 04, 2001 7:01 PM 
To: Housley, Russ; Santosh Chokhani 
Cc: [email-masked] 
Subject: RE: delta CRLs 
 
I am not sure about rule 2. Surly the CRL number of the base and delta 
are orthogonal. The delta indicator binds the delta to a specific base 
in the base CRL sequence, but the absolute value of the two sequences 
are independent. A CA may have been issuing base CRLs for some time, 
before it gets into the business of using delta CRLs and it does not 
really matter it the delta CRL number starts at 1 or the current number 
of the base. 
To clarify point three, the delta CRL must include "remove from" entries

until the nextupdate time in the referenced base. A CA does not know if 
clients have picked up the base or knot, and to assume they have would 
introduce an error. 
  
Trevor 
  
-----Original Message----- 
From: Housley, Russ [mailto:[email-masked]
<mailto:[email-masked]> ] 
Sent: Friday, May 04, 2001 1:32 PM 
To: Santosh Chokhani 
Cc: [email-masked] 
Subject: RE: delta CRLs 
  
Santosh: 
I see your point. 
There are three rules that interact to make it all work, and I think 
that we are only clear about two of the rules. 
1.  The base CRL referenced by the delta CRL MUST be less than or equal 
to the base CRL to which the updates will be applied. 
2.  The CRL number in the delta CRL MUST be greater than or equal to the

CRL number of the base (otherwise the entries are already accommodated 
by the base). 
3.  Delta CRLs MUST continue to include removeFromCRL entries even if 
they are not otherwise needed to update the referenced base.  David's 
posting provided the rules to describe when they are not longer 
necessary. 
Russ