Subject: RE: delta CRLs

From: Santosh Chokhani <[email-masked]>
Date: Sat, 5 May 2001 07:58:18 -0400

Trevor:

The 2000 version of X.509 is very clear on this.  For a given CRL stream
identifier, the CRL number is unique whether it is base or delta.  That is
why delta number has to be greater than the base.

However, since the CRL number is not a mandatory extension (although PKIX
profile requires it), a check based on thisUpdate is more general and
preferred.

As for rule 3, I did not mention it, but this is a CRL generation rule and
applicable to the CA, where as first two rules are CRL processing rule and
hence applicable to relying parties.  I hope the revision will put these
rules in different places for processing and generation.

The processing rule should be that if the removeFromCRL is on delta, then
the entry (if present in the base) should be deleted.

-----Original Message-----
From: Trevor Freeman [mailto:[email-masked]]
Sent: Friday, May 04, 2001 7:01 PM
To: Housley, Russ; Santosh Chokhani
Cc: [email-masked]
Subject: RE: delta CRLs

I am not sure about rule 2. Surly the CRL number of the base and delta
are orthogonal. The delta indicator binds the delta to a specific base
in the base CRL sequence, but the absolute value of the two sequences
are independent. A CA may have been issuing base CRLs for some time,
before it gets into the business of using delta CRLs and it does not
really matter it the delta CRL number starts at 1 or the current number
of the base.
To clarify point three, the delta CRL must include "remove from" entries
until the nextupdate time in the referenced base. A CA does not know if
clients have picked up the base or knot, and to assume they have would
introduce an error.
 
Trevor 
 
-----Original Message-----
From: Housley, Russ [mailto:[email-masked]] 
Sent: Friday, May 04, 2001 1:32 PM
To: Santosh Chokhani
Cc: [email-masked]
Subject: RE: delta CRLs
 
Santosh:

I see your point.

There are three rules that interact to make it all work, and I think
that we are only clear about two of the rules.

1.  The base CRL referenced by the delta CRL MUST be less than or equal
to the base CRL to which the updates will be applied.

2.  The CRL number in the delta CRL MUST be greater than or equal to the
CRL number of the base (otherwise the entries are already accommodated
by the base).

3.  Delta CRLs MUST continue to include removeFromCRL entries even if
they are not otherwise needed to update the referenced base.  David's
posting provided the rules to describe when they are not longer
necessary.

Russ