Subject: CRL size

From: sankar ramamoorthi <[email-masked]>
Date: Wed, 13 Jan 1999 13:17:22 -0800 (PST)

Question on CRL size.

I have a thin client which needs to verify a certificate validity. The
plan is for the thin client
to communicate with a backend database server to get
the CRL associated with the cert. serial number. The
database is used only as a repository for CRLs.
The thin client only trusts the CA, so it can not
ask the backend to verify the certificate and hence
needs to get the associated CRL unit. There is also
no plan to implment OCSP in the thin client. 

The question is - what can I assume about the size
of the CRL unit? What is the minimum size of CRL unit
that is signed by the CA? I need to know the size to ensure it
ismanagable by the thin client and yet
can be fully trusted by it. 

Ideally I would like the CRLs to be distributed in
managable quantas and each quanta is a signed by the
CA. The backend database acts as repository for these
signed CRL quantas, and the thin client is able to
validate the cert by querying for the associated
CRL quanta.

Thanks for any input,

-- sankar --

PS: I admit I have not fully gone through all the
PKIX drafts. I had briefly scanned through them, but was getting lost.

_________________________________________________________
DO YOU YAHOO!?
Get your free @yahoo.com address at http://mail.yahoo.com