Subject: RE: delta-CRLs (was Re: Last Call:draft-ietf-pkix-new-part1-06.txt comments)

From: "David Cross" <[email-masked]>
Date: Sat, 21 Apr 2001 16:07:07 -0700

Understood - however, you may be penalizing the CA and the supporting
infrastructure to replicate a full base CRL versus a smaller delta-CRL
only.  That is why so many people would like it to be a MAY.

David B. Cross

> >In the third paragraph the first sentence (still) says:
> >
> > >    When a conforming CA issues a delta CRL, the CA MUST also issue

> > > a CRL

Originally, this sentence was placed in RFC 2459 to ensure that simple 
clients are able to get the best possible revocation information.  We
did 
not want to require CAs or clients to support delta-CRLs, but if a CA
chose 
to support delta-CRLs, we did not want to penalize clients.

I do not see that either of these desires has changed.

Russ

---

From: "Trevor Freeman" <[email-masked]>
Date: Sun, 22 Apr 2001 19:33:43 -0700

Yes,
If a CA has not updated its CRL, the OCSP client may be aware of a
revocation that the CRL client is not - which h is the reason put
forward by Russ for publishing base and delta at the same time.
Trevor

-----Original Message-----
From: Michael Myers [mailto:[email-masked]] 
Sent: Sunday, April 22, 2001 6:18 PM
To: Trevor Freeman; Housley, Russ; [email-masked]
Subject: RE: delta-CRLs (was Re: Last
Call:draft-ietf-pkix-new-part1-06.txt comments)

Trevor,

Is your differentiator timeliness?

Mike

> -----Original Message-----
> From: Trevor Freeman [mailto:[email-masked]]
> Sent: Sunday, April 22, 2001 5:28 PM
>
> . . .
> An OCSP aware client may have a different answer to CRL
> aware clients to the revocation status of a certificate.
> . . .