Subject: Re: Part1 last call comments

From: "Paul Hoffman / IMC" <[email-masked]>
Date: Fri, 23 Feb 2001 13:59:02 -0800

The latter set of Jim's comments should cause some alarm on this 
list. It appears that the ASN.1 modules have not been checked, except 
by Jim Schaad.

It isn't appropriate to pass this on to IETF last call until we have 
at least one (and hopefully two) people have verified on the list 
that each of the modules have passed through their ASN.1 verifiers 
with no errors. It would be nice if anyone verifying the modules 
could list the warnings that their parsers dump out.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: David Kemp <[email-masked]>
Date: Tue, 27 Feb 2001 11:09:38 -0500 (EST)

> From: Jean-Marc Desperrier <[email-masked]>
> 
> This is not the date _at_ which the next revocation list will be issued, but
> _by_which the CRL is garanteed to have been issued.
> 
> This garantee covers the case where there's a problem and the
> issuance/propagation of the CRL is slightly delayed.

nextUpdate is the date _at_ which the next _scheduled_ CRL will be issued,
as opposed to unscheduled CRLs issued in response to, e.g., reported
key compromises.

X.509 says _by_ which in order not to preclude the issuance of
unscheduled CRLs.

I'm not going to quibble about whether a few wallclock minutes +/-
disqualifies a CRL from being issued "_at_" a specific time;  the
property of interest is that for a scheduled CRL, the "thisUpdate"
field exactly equals the "nextUpdate" field of the previous CRL in
the series.