Subject: Re: Certificate verification algorithm

From: [email-masked]
Date: Thu, 16 Mar 2000 11:06:22 -0500

I think you're probably right about updating approved_reasons by doing
unions rather than intersections.  Here's an example of why, which neglects
CRL Distribution Points as unnecessary to this point.  Suppose that every
CRL processed has a single-bit value in onlySomeReasons (inside
issuingDistributionPoint) and which-reasons is initialized to a two-element
set, approved_reasons starts as an empty value and can never take on any
value with more than one element by performing intersections.  Thus step
1-d of section 6.3.3 will always result in the certificate being rejected,
since approved_reasons will never be a superset of which-reasons.

          Tom Gindin

---

From: "Valery Smyslov" <[email-masked]>
Date: Fri, 17 Mar 2000 09:20:05 +0300

On 16 Mar 00, at 11:06, [email-masked] wrote:

Tom,

thank you for good example. That's exactly what I meant.

Best regards,
Valera.