Subject: RE: CRL size

From: Alan Lloyd <[email-masked]>
Date: Thu, 14 Jan 1999 11:20:05 +1100

Sankar - there are many system and operational assumptions based or your
request/requirements. 
ie if the system has a small number of locally contained users, the CA
DB and the CRLs can live in a single DB and then its just over to
estimating the reasons and frequency of revocation and putting in the
CRL fragment algorithm processing in the client and the CA that matches
your needs.

If your system needs to scale and deal with multi CA domains with high
revocation rates across many DBs or interconnected directory systems,
the similar estimation must be taken in line with the total CA/CRL
directory information model and validation processes. And standards
should be applied.

I don think you can just guess this situation unless the system and the
trusted transactions betwen the users and CAs in the system is
proprietary and self contained.
Otherwise it is a User/Revocation rate assessment and how the resultant
CRLs are managed, placed and tested.

Some firm system details may help.

Hope this helps.

regards alan

> -----Original Message-----
> From:	sankar ramamoorthi [SMTP:[email-masked]]
> Sent:	Thursday, 14 January 1999 8:17
> To:	[email-masked]
> Subject:	CRL size
> 
> Question on CRL size.
> 
> 
> I have a thin client which needs to verify a certificate validity. The
> plan is for the thin client
> to communicate with a backend database server to get
> the CRL associated with the cert. serial number. The
> database is used only as a repository for CRLs.
> The thin client only trusts the CA, so it can not
> ask the backend to verify the certificate and hence
> needs to get the associated CRL unit. There is also
> no plan to implment OCSP in the thin client. 
> 
> The question is - what can I assume about the size
> of the CRL unit? What is the minimum size of CRL unit
> that is signed by the CA? I need to know the size to ensure it
> ismanagable by the thin client and yet
> can be fully trusted by it. 
> 
> Ideally I would like the CRLs to be distributed in
> managable quantas and each quanta is a signed by the
> CA. The backend database acts as repository for these
> signed CRL quantas, and the thin client is able to
> validate the cert by querying for the associated
> CRL quanta.
> 
> Thanks for any input,
> 
> -- sankar --
> 
> 
> PS: I admit I have not fully gone through all the
> PKIX drafts. I had briefly scanned through them, but was getting lost.
> 
> 
> 
> 
> 
> 
> _________________________________________________________
> DO YOU YAHOO!?
> Get your free @yahoo.com address at http://mail.yahoo.com