Subject: RE: delta-CRLs (was Re: LastCall:draft-ietf-pkix-new-part1-06.txt comments)

From: "David Cross" <[email-masked]>
Date: Sun, 22 Apr 2001 19:44:46 -0700

Mike:

Yes, exactly, if I understand your statement correctly.  With network
replication and bandwidth limitations, the goal of many SHOULD be to
issue a base CRL less frequently with a longer validity and more
delta-CRLs with increased frequency and shorter validity.  This in my
mind is the orignal intent and ideal scenario for delta-CRL usage.  

Having a goal of making identical revocation status information to both
delta-aware and non delta-aware clients may be noble, but invariably
detracts from the ideal scenario described above.  If all CA vendors
would be compliant in issuing both, this would surely hurt
implementations and deployments due to the negative consequences to an
infrastructure.

David B. Cross

-----Original Message-----
From: Michael Myers [mailto:[email-masked]] 

Dave,

Recognizing broader enterprise issues, somwhere there's nonetheless a
middle ground where the mandatory practice of a full CRL complements the
optional practice of issuing deltas.  The period of the former MAY,
perhaps SHOULD, be longer than the latter in the presence of the delta
practice.  Your thoughts?

Mike

> -----Original Message-----
> From: David Cross [mailto:[email-masked]]
>
>
> It may not be a burden to a CA, but it very well likely may be burden 
> for the underlying replication and distribution architecture to push a

> full CRL every time a delta-CRL is issued.  It is the bigger picture 
> of the issue outside of the CA and PKI aspects.
>
>
> David B. Cross
>

---

From: "David Cross" <[email-masked]>
Date: Mon, 23 Apr 2001 20:25:41 -0700

Sorry, but to be blunt, how is this any different from an OCSP aware
client from a CRL aware client?

The CA operator knows and anticipates the needs of clients and builds a
publication schedule and revocation architecture accordingly.
 
David B. Cross

-----Original Message-----
From: Paul Hoffman / IMC [mailto:[email-masked]] 
Sent: Monday, April 23, 2001 4:21 PM
To: Ambarish Malpani; [email-masked]
Subject: RE: delta-CRLs (was Re:
LastCall:draft-ietf-pkix-new-part1-06.txt comments)

At 1:02 PM -0700 4/23/01, Ambarish Malpani wrote:
>     Even if you are requiring clients to pull the CRLs from your 
>directory, you still need to have enough bandwidth to and replication 
>of the directory to support all the clients who need to pull the new 
>CRL every time it is issued.

The alternative is that some users would have a different (that is, 
better) list of what is in the CRL than others, and those others 
would have no way of knowing that their list of revoked certificates 
is incomplete. That seems pretty awful to me. To be a bit crass, if 
you don't have the bandwidth, force your users use delta CRLs, or 
don't be a CA.

If for some reason the wording in son-of-2459 goes towards not 
requiring a new CRL being issued, there also needs to be a fairly 
stern warning both in the delta CRL section and in the security 
considerations section saying that some users will have different 
views of what certificates have been revoked, and that they won't 
know it.

--Paul Hoffman, Director
--Internet Mail Consortium