Subject: RE: large crl's

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 20 Sep 2006 10:27:06 -0700

Phillip,

For the scenarios you cite, I encourage you to look at the LTANS working
group work as well as specific I-D related to getting archived PKI
artifacts.

As you know, verifying old signatures entails more than simply having a
cumulative CRL.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Hallam-Baker, Phillip
Sent: Wednesday, September 20, 2006 9:49 AM
To: Stephen Kent; Christine Karman
Cc: Kemp David P.; [email-masked]
Subject: RE: large crl's

If you want to have an archival capability knowing the revocation status
of expired certificates is an essential operational capability.

If the CRL does not have that information it is not an appropriate
technology for that application.

In a messaging environment you are very likely to want archival
capabilities and in particular the ability to query the status of the
certificate on a particular day.

For SSL it does not matter as the only status that matters is current
status.

If Ben Franklin had signed the US constitution with a digital signature
people would probably want to know if it was still valid after his
certificate had expired.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Stephen Kent
> Sent: Tuesday, September 19, 2006 8:56 PM
> To: Christine Karman
> Cc: Kemp David P.; [email-masked]
> Subject: RE: large crl's
> 
> 
> At 11:04 AM +0200 9/19/06, Christine Karman wrote:
> >...
> >Another difference between authentication in a browser and 
> email is the 
> >following. A company archives old email. They have to be 
> able to verify 
> >validity of digital signatures on incoming email, even for 
> certificates 
> >that have expired long ago. The DOD will have to have that 20Mb crl 
> >available forever, unless they switch to online verification.
> 
> There is no requirement for a CA to maintain entries on a CRL 
> after the certs in question have expired.  Your model re CRL 
> management is inconsistent with RFC 3280 requirements.
> 
> Steve
> 
> 
>