Subject: RE: Usage of CRL Issuing Distribution Point

From: Alex Deacon <[email-masked]>
Date: Fri, 12 Feb 1999 14:24:28 -0800

From reading the docs, I don't get the impression that CDP and IDP
explicitly exclude the use other attributes.  I take this to (implicitly)
imply that other attributes CAN be used to partition CRL's. Is this to big
of a leap of faith to make? 

Partitioning a CRL by serialNumber sounds very reasonable to me.  So does
partitioning a CRL by some extension value which may be present in all certs
issued by a particular CA.  Why not partition a CRL by using the notBefore
validity date on the cert?  Or, perhaps the CA keeps an internal counter and
creates a new partition for every 20 certs it issues.  In an extreme case,
you may want each cert to have it own CRL partition.

If CDP's and IDP's are being used properly, (i.e. they are present in all
certs and CRL's issued by a CA) then what difference does it make as to how
the partitions were created?  

Alex

> -----Original Message-----
> From: Trevor Freeman [mailto:[email-masked]]
> Sent: Friday, February 12, 1999 12:47 PM
> To: 'Alex Deacon'
> Cc: [email-masked]'
> Subject: RE: Usage of CRL Issuing Distribution Point
> 
> 
> What extensions in these documents provide for other 
> attributes to be used
> to partition CRLs? 
> -----Original Message-----
> From: Alex Deacon [mailto:[email-masked]]
> Sent: Friday, February 12, 1999 12:40 PM
> To: Trevor Freeman
> Cc: [email-masked]'
> Subject: RE: Usage of CRL Issuing Distribution Point
> 
> 
> Trevor, 
> 
> Could you specify what document states that it is not 
> permitted for CRL's to
> be partitioned on the basis of other attributes such as 
> serial number?  I
> cant recall ever seeing such a statement in either PKIX Part 
> 1 or X.509.
> 
> Thanks
> Alex
>

---

From: "Ambarish Malpani" <[email-masked]>
Date: Fri, 12 Feb 1999 17:17:29 -0800

I agree with Alex's interpretation of the spec. There is
nothing to prevent a CA from creating a new DP for every n
certificates it issues. All it needs to do, is give the new
DP a name and put that name in the certificate. 

Any application that is trying to verify the status of that
certificate, can go retrieve the appropriate DP and ensure
that the cert isn't in it.

By the way, are there any CAs that support CRLDP as a way to
break up a CRL into smaller chunks, or is everybody just
using CRLDP to point to the one monolithic CRL they publish?

Also, is anybody using CRLDP to create multiple CRLs (potentially
published at different frequencies), where the CRLs are
used for different revocation reasons - keyCompromise etc.

Anybody planning to support CRLDP in those ways?

Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect					         650.567.5457
ValiCert, Inc.				        [email-masked]
1215 Terra Bella Ave.		              http://www.valicert.com
Mountain View, CA 94043-1833

> From: [email-masked] 
> [mailto:[email-masked]]On Behalf
> Of Alex Deacon
> Sent: Friday, February 12, 1999 2:24 PM
> To: 'Trevor Freeman'
> Cc: [email-masked]'

---

From: "Ambarish Malpani" <[email-masked]>
Date: Sat, 13 Feb 1999 19:02:09 -0800

Hi All,
    I would like to repost a question I had asked in a previous
mail (in case it got lost).

Here goes:

Are there any CAs/product vendors that support CRLDP as a way to
break up a CRL into smaller chunks, or is everybody just
using CRLDP to point to the one monolithic CRL they publish?

Anybody using CRLDP in other interesting ways?

Anybody planning to support CRLDP in all these different modes?

If people don't want to post to the whole list, I would
still appreciate private emails (and if there is no
confidentiality involved, would be happy to post a summary
on the list).

Regards,
Ambarish