Subject: RE: delta CRLs

From: Ambarish Malpani <[email-masked]>
Date: Tue, 08 May 2001 20:57:07 -0700

I always thought MAX for ASN.1 INTEGERs was something I would never
need to worry about.

Looks like I was wrong :-)

By the way, what is MAX? I know that we can represent numbers with
over 2048 bits...

A

-----Original Message-----
From: Carlin Covey
To: Housley, Russ; Santosh Chokhani
Cc: [email-masked]
Sent: 5/8/01 5:53 PM
Subject: RE: delta CRLs

Russ,

A week or two ago we arrived at a consensus to remove the requirement
that a CA issue a full CRL whenever the CA issues a Delta-CRL.  If the
CA chooses to issue them simultaneously, why would they need to be
numbered
the same?  If this requirement were lifted, it seems like requiring the
CRL
number to be "strictly increasing" in a sequence would be preferable to
"monotonically increasing".  "Monotonically increasing" allows the
possibility
that the CRL number never changes, which seems undesirable.  I realize
that in either case the CRL number might wrap around at some point in
the
future.
That is inevitable, given that that CRL number is defined as INTEGER
(0..MAX).
What else can a CA do when CRL number reaches MAX, stop issuing CRLs?

"monotonically increasing" - Definition: A function from a partially
order[ed]
domain to a partially ordered range such that x >= y implies f(x) >=
f(y).

- From the NIST web site:
http://hissa.nist.gov/dads/HTML/monotoncincr.html

Regards,

Carlin

____________________________

-  Carlin Covey
   Cylink Corporation

-----Original Message-----
From: Housley, Russ [mailto:[email-masked]]
Sent: Monday, May 07, 2001 6:21 AM
To: Santosh Chokhani
Cc: [email-masked]
Subject: RE: delta CRLs

Santosh:

X.509 may allow the CRL number to wrap around, but I do not believe that
PKIX does.

    5.2.3  CRL Number

    The CRL number is a non-critical CRL extension which conveys a
    monotonically increasing sequence number for each CRL issued by a
CA.
    This extension allows users to easily determine when a particular
CRL
    supersedes another CRL.  CAs conforming to this profile MUST include
    this extension in all CRLs.

    id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }

Russ

At 10:11 PM 5/5/2001 -0400, Santosh Chokhani wrote:

>Actually, the text allows for the wrap of the numbers.  Please see
Annex B
>of X.509.  Thus, it is not strictly increasing
>
>-----Original Message-----
>From: Peter Sylvester
>[<mailto:[email-masked]>mailto:[email-masked]]
>Sent: Saturday, May 05, 2001 2:08 PM
>To: [email-masked]; [email-masked];
>[email-masked]
>Cc: [email-masked]
>Subject: RE: delta CRLs
>
> > Trevor:
> >
> > The 2000 version of X.509 is very clear on this.  For a given CRL
stream
> > identifier, the CRL number is unique whether it is base or delta.
That
is
> > why delta number has to be greater than the base.
>
>" 8.5.2.1 CRL number extension
>
>   This CRL extension field conveys a monotonically increasing sequence
> number .."
>
>The text might be clearer IMHO if 'strictly increasing' would be used
>instead.