Subject: RE: Delta CRL Distribution Points

From: Carlisle Adams <[email-masked]>
Date: Tue, 5 Oct 1999 11:35:01 -0400

Hi Phill,

> ----------
> From: 	Phillip M Hallam-Baker[SMTP:[email-masked]]
> Sent: 	Thursday, September 30, 1999 11:24 AM
> To: 	Trevor Freeman; Pkix List (E-mail)
> Subject: 	RE: Delta CRL Distribution Points
> 
> As I said earlier, delta CRLs are problematic and managing them is
> intrinsically complex. Scope CRLs offer considerably more flexibility,
> are intrinsically simpler and in many cases address the same need.
 
I don't understand your comment that deltas are problematic and that
managing them is intrinsically complex.  Perhaps it stems from your earlier
comment:

	I believe that the root of the complexity in this case is attempting
to
	manage a situation where multiple signed documents issued at
different
	times must be combined to validate a certificate. This is an
intrinsic
	problem with both Delta CRLs and Paul Kocher's CRTs. If the voulme
of
	updates becomes large there is a scalability problem which manifests
	itself as a reliability issue as opposed to a performance issue.

In practice, there are not "multiple signed documents ... that must be
combined to validate a certificate".  There's no real combining going on.  I
have a base cached on my local system and I want to check an incoming
certificate.  I retrieve the latest delta.  Is the cert serial number on the
base?  (Yes or No.)  If not, is it on the delta?  (Yes or No.)

Conceptually, you can think of the relying party combining the base and
delta into a single larger CRL and checking that, but in actual code nobody
needs to combine these things at all.  A sequential check of the two lists
is sufficient.  Checking two lists instead of one does not seem to me to be
inherently "problematic" or an "intrinsically complex" management task.

What have I missed?

Carlisle.

P.S., Scopes are great, and offer wonderful flexibility.  But do they really
help with the timeliness issue (which is where deltas are particularly
intended to be useful)?  In other words, do scopes and deltas really address
the same need in many cases?

---

From: [email-masked]
Date: Tue, 12 Oct 1999 19:48:06 +0400

On 5 Oct 99, at 11:35, Carlisle Adams wrote:

> certificate.  I retrieve the latest delta.  
	
Excuse me, in this point of CRL processing I have a question:
Say, a system has only baseCRL ( retrieved with certificate CRL 
distribution point ). Okay, certificate is checked and good. But
here is some doubt - Is it possible that certificate has been revoked 
in delta-CRL? Okay, let me think... look around what I have at the
moment: CRLDP and the same IDP in CRL (say it looks like 
http://somefirm/revokedcerts.crl). How can I find any information
where I can get deltaCRL? I see only one possibility:
	default distribution point - value of attribute deltaRevocationList
      in CA entry of Directory;

What have I miss?

> Is the cert serial number on the

____________
Pavel Krylov