Subject: RE: Huge CRLs

From: "Salz, Rich" <[email-masked]>
Date: Tue, 28 Sep 1999 10:08:45 -0400

>In short, when you get an OCSP request, you set the response-type
>as a CRT based response and then include the CRT slice in the
>response. This means that you don't sign the specific response,
>so the creator of the CRT and the provider of the response can
>be different entities - one with a private key (to sign the CRT)
>and the other without any private key (since it is just doling
>out responses based on a trusted CRT).

Thanks very much, it does.  Now, I can just replace "crt" with "crl"
above and get the exact same security feature, right?  (Granted the
CRT is smaller than the CRL, but that's not what the issue here.)

	/r$

---

From: "Ambarish Malpani" <[email-masked]>
Date: Tue, 28 Sep 1999 16:46:18 -0700

Hi Rich,
    Yes, you could, but the original topic was, Huge CRLs, so I
think size is very much the issue here! Remember - the assertion
was about CRTs being more secure and more scalable than OCSP. You
can always use CRLs if they meet your needs - don't really need
OCSP to support that.

Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
1215 Terra Bella Ave.                         http://www.valicert.com
Mountain View, CA 94043-1833

> -----Original Message-----
> From: Salz, Rich [mailto:[email-masked]]
> Sent: Tuesday, September 28, 1999 7:09 AM
> To: 'Ambarish Malpani'; [email-masked]
> Subject: RE: Huge CRLs
> 
>