Subject: RE: delta-CRLs and NR

From: "Tom Gindin" <[email-masked]>
Date: Tue, 24 Apr 2001 13:42:44 -0400

When non-repudiation is an actual practice, doesn't the revocation
status need to be checked as of a time no earlier than the actual signature
of the non-repudiable message or document?  And won't a full CRL (or a
delta, for that matter) rarely have been published with such an effective
time at the time an RP initially receives such a message or document?
     It is perfectly true that it is much easier to check a single full CRL
than a CRL with deltas.  However, I don't see why the problem is more
severe for NR except that an NR system is even less tolerant of false
negatives on revocation than authentication is.

          Tom Gindin

"Michael Myers" <[email-masked]> on 04/23/2001 02:30:39 PM

To:   "David P. Kemp" <[email-masked]>, <[email-masked]>
cc:
Subject:  RE: delta-CRLs (was Re: LastCall:draft-ietf-pkix-new-part1-06.txt
      comments)

Dave,

But in a broader sense, isn't that precisely the problem directory
replication is all about?

It would be useful to hear of empirical studies establishing the extent to
which PKI information management today dominates directory (X.500, LDAP)
operations.  I advocate that we need to know what today's ground truth
tells
us before we flip this parity bit; else wiggle the text as I proposed and
so
provide everybody the tuning knobs they want to tailor the standard to
local
needs.

More tactically, one could produce a full CRL as a "backup" but let the
delta practice take the burden of timeliness and bandwidth efficiency.  But
in all cases where non-repudiation becomes a true (vice theoretical) issue,
there MUST be a full CRL around somewhere that cleanly establishes a
context.  Else one is faced with reconstituting the full context via
re-accumulation of all the relevant deltas.  Not an easy task either, and
one prone to error.  Given the ease with which a full CRL can be produced
(assuming mechanisms are in place to produce deltas), just crontab two
periods:  a "full" production and a "delta" production, with the period of
the latter shorter than the former.  You don't have to push the full CRL
all
over the place, but at a minimum certainly have it available.

A systems-level tradeoff, as always.  But dumping full CRLs entirely and
trusting deltas exclusively isn't something I'd advocate to any enterprise
concerned about its risk management practices.

Mike

> -----Original Message-----
> From: [email-masked]
> . . .
> The problem is that once the full CRL is signed, it is transmitted across
> the network to directory/database/repository replicas and to clients.
> If you are a PKI provider (as I am), and you have to provision 3.5
> million subscribers, the cost of that provisioning with full CRLs is
> prohibitive, whereas the cost of provisioning with deltas is not.

---

From: "Michael Myers" <[email-masked]>
Date: Tue, 24 Apr 2001 11:31:45 -0700

Tom,

Perhaps I should have used the term "dispute resolution process" instead of
"non-repudiation".  I was thinking more in terms of that process and the
general notion that one can never have too much documentation proving one's
point--i.e. in this case the indisputably "full" CRL-- whereas in day to day
activities the efficiencies gained by deltas cover what undoubtedly will be
the vastly larger number of undisputed transactions.

So I was thinking that it would be unwise for us to needlessly burden 99%(?)
of the solution space to address issues associated with the remaining 1%,
hence break out fulls from deltas.  Now, I'm not a lawyer, but that all
said, I think the assured presence of a full CRL in the case of a "dispute
resolution event" would very useful to that 1%.  One is otherwise faced with
proving that one had fully accumulated all relevant deltas.  Thus mandate
fulls as an assured baseline regardless of the PKI context, but with perhaps
a longer production period that nonetheless contributes evidence to a
possible discovery process.  Again, I'm not a lawyer, but I have played with
them on the street.

Ultimately, I'm still convinced that the only effective resolution is a
dynamically produced, digitally signed assertion (i.e. OCSPv2 with its DPV
extension).  But that's an entirely different buffalo hunt.

Mike

> From: Tom Gindin [mailto:[email-masked]]
> Sent: Tuesday, April 24, 2001 10:43 AM
> To: Michael Myers
> Cc: David P. Kemp; [email-masked]
> Subject: RE: delta-CRLs and NR
>
>
>