Subject: RE: delta-CRLs (was Re: Last Call:draft-ietf-pkix-new-part1-06.tx t comments)

From: Ambarish Malpani <[email-masked]>
Date: Sun, 22 Apr 2001 18:36:29 -0700

Hi Eric,
    I don't have any problems with issuing new CRLs every few
seconds - unfortunately, some of the CA vendors do :-)

Anyway, the problem people have with issuing full CRLs at every
revocation is the amount of extra processing they do with the
CRL - e.g. back it up in their database, create some kind of
audit trail, lookup all the revoked certificates in their
database, etc.

I have heard more than 1 CA vendor balk at the idea of issuing a
new CRL for every revocation event, so I must believe that this is
a pretty expensive operation.

Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
339 N. Bernardo Ave.                          http://www.valicert.com
Mountain View, CA 94043

> -----Original Message-----
> From: Eric Rescorla [mailto:[email-masked]]
> Sent: Sunday, April 22, 2001 6:20 PM
> To: Ambarish Malpani
> Cc: 'Housley, Russ'; [email-masked]
> Subject: Re: delta-CRLs (was Re: Last
> Call:draft-ietf-pkix-new-part1-06.tx t comments)
> 
> 
> Ambarish Malpani <[email-masked]> writes:
> 
> > Russ, the problem with this is that CAs might be unwilling to issue
> > delta-CRLs because issuing a full CRL every time is too
> > burdensome.
> Ambarish, could you explain why the cost of issuing a full
> CRL is too burdensome? Surely it's not the cost of the signature
> itself you're concerned with.
> 
> -Ekr
>

---

From: "Trevor Freeman" <[email-masked]>
Date: Sun, 22 Apr 2001 19:33:41 -0700

It is not the cost associated with generating the base CRL but the over
all system cost which is in question, e.g. the cost associated with the
distribution of the CRL with replicated distribution mechanisms. If you
publish a CRL to a directory, and that directory has multiple replicas,
then there is a knock on effect when one instance of the directory is
updated. The update is then replicated to all other instances. If you
are not using a replicated directory, you may be using a replicated web
server, which will have the same problem. Then there are bandwidth
implications. Even in this day and age, bandwidth may be limited, and
downloading a full CRL has a cost associated with it.

-----Original Message-----
From: Eric Rescorla [mailto:[email-masked]] 
Sent: Sunday, April 22, 2001 6:20 PM
To: Ambarish Malpani
Cc: 'Housley, Russ'; [email-masked]
Subject: Re: delta-CRLs (was Re: Last

-Ekr