Subject: Publishing Base CRL's & replicating publication mechanisms

From: Trevor Freeman <[email-masked]>
Date: Fri, 1 Oct 1999 11:51:52 -0700

Partitioned CRL's helps the client out by reducing the size of the
individual CRL that needs to be downloaded. It may seem an obvious
observation, but it does nothing to help out the impact on the
infrastructure if you have a replicating publication mechanism. If a CA has
100K revocations on its list, then the impact of publishing new revocation
data on the infrastructure is pretty much the same if you have 1 or 1K
CRL's. The underlying infrastructure is understandably oblivious to the
details of the change, only to the fact that a change has been made and
needs to be replicated.  Publishing a delta CRL without publishing a base
CRL would address this problem. More current revocation information can then
be published, while minimizing the impact on the infrastructure. 
Therefore my proposal is to remove the current mandate that a base CRL be
published every time a delta CRL is published.
Trevor

---

From: "Phillip M Hallam-Baker" <[email-masked]>
Date: Fri, 1 Oct 1999 15:49:47 -0400

I believe the answer lies in your reading of the term 'published' which
as has previously been established cannot be mandated by the spec.

I believe that last time we looked at this it was decided that the spec
could mandate CREATION of a base CRL each time a delta was created but
could not mandate that it be sent anywhere! So an implementation that
'published' the CRL straight to /dev/null could be seen as 'compliant'!

This tends to support the idea that mandating a base update is not a
reasonable requirement since it cannot be enforced.

I believe that the motivation for this requirement was to allow
implementation of delta CRLs to be made optional since some consider
systems in which two CRLs (base and delta) must be obtained and
corellated to be intrinsically more complicated than systems in which
only one CRL (base) need be obtained.

		Phill

> -----Original Message-----
> From: Trevor Freeman [mailto:[email-masked]]
> Sent: Friday, October 01, 1999 2:52 PM
> To: Pkix List (E-mail)
> Subject: Publishing Base CRL's & replicating publication mechanisms
>
>

---

From: "David A. Cooper" <[email-masked]>
Date: Fri, 01 Oct 1999 16:10:00 -0400

>published every time a delta CRL is published.

I would suggest looking at the X.509 FPDAM on certificate extensions (available
at ftp://ftp.bull.com/pub/OSIdirectory/documentsForBallot/CertExtFPDAM.doc or
ftp://ftp.bull.com/pub/OSIdirectory/documentsForBallot/CertExtFPDAM.pdf).

In particular, look at the proposed text for the CRL scope field (section 12.5.2.5) and
the delta CRL indicator field (section 12.6.3.3). Also look at section 12.6.4.

Dave