Subject: Removing Expired Revoked Certificates

From: "David Simonetti" <[email-masked]>
Date: Fri, 4 May 2007 09:05:56 -0400 (EDT)

Section 3.3 of RFC 3280 states,

"An entry MUST NOT be removed from the CRL until it appears on one
regularly scheduled CRL issued beyond the revoked certificate's validity
period."

Why is this?  For dCRLs I can understand, but otherwise it would seem that
once a revoked certificate expires, that its entry on the CRL could expire
as well.

-- 
Regards,
David Simonetti
Jacob & Sundstrom, Inc.
410-356-1067

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 4 May 2007 07:23:15 -0700

Dave,

The motivation is to make sure that archived CRLs can support
non-repudiation by recording all the certificates that have been revoked
and when.  Thus, the goal is that an entry must appear on at least one
CRL.  X.509 language is more precise.  3280 decided to meet the goal by
writing the language you cite as opposed to saying that an expired entry
can be deleted as long as it has appeared in one published CRL.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of David Simonetti
Sent: Friday, May 04, 2007 9:06 AM
To: [email-masked]
Subject: Removing Expired Revoked Certificates

Why is this?  For dCRLs I can understand, but otherwise it would seem
that
once a revoked certificate expires, that its entry on the CRL could
expire
as well.

-- 
Regards,
David Simonetti
Jacob & Sundstrom, Inc.
410-356-1067

---

From: "Kemp, David P." <[email-masked]>
Date: Fri, 4 May 2007 10:39:00 -0400

Consider a regularly scheduled CRL issued at time A, the next scheduled
CRL issued at time C and a cert expiring at time B (for A < B < C).

A relying party holding CRLs A and C, both with no entry for the cert,
knows that the cert was not revoked before it expired.  If the section
3.3 requirement did not exist, the relying party would have no way
of knowing if the cert had been revoked at some time between A and B.

Dave

-----Original Message-----

-- 
Regards,
David Simonetti
Jacob & Sundstrom, Inc.
410-356-1067

---

From: "David Simonetti" <[email-masked]>
Date: Fri, 4 May 2007 11:26:09 -0400 (EDT)

Thanks, all!  Makes perfect sense to me now.

Regards,
Dave S.

-- 
Regards,
David Simonetti
Jacob & Sundstrom, Inc.
410-356-1067

---

From: Russ Housley <[email-masked]>
Date: Fri, 04 May 2007 16:10:04 -0400

Dave:

There was a very long discussion about this in the late 1990s.

Consider an issuer that publishes a CRL every 7 days.  If the 
certificate is revoked and expired in the 7 day period, then no 
relying party will be able to determine that the revocation 
happened.  This practice makes sure that the revocation appears on at 
least one CRL, which could be very important in dealing with 
non-repudiation.   Some signature archive policies require the 
archive to include the CRL that was available at the time the 
signature was generated and the next one that is published because of 
this situation.

Russ