Subject: Delta CRL's and Publication Replication Latency

From: Trevor Freeman <[email-masked]>
Date: Wed, 29 Sep 1999 15:33:00 -0700

If it fairly common to have publication mechanism for CRL's such as file
systems, LDAP directories etc, which use replication. This introduces a
delay between publication and the new version being available to at
replicas.  Similarly inter-directory synchronisation also introduces a delay
between publication and availability. The proven solution for these
situations is to extend the next update time of the CRL, e.g. publish every
week, mark the next update time as 8 days after the this update time of  the
CRL. In doing so you loose an interesting piece of information that is the
true publication period of the CRL. This is OK for full CRL's where
typically you would expect the replication time << publication period so the
difference between the apparent and true publication period is small. Delta
CRL are different in that it is far more likely for the replication time to
be > publication period, therefore the difference between the apparent and
true publication period will be large. Publishing every week and adding on 8
hours for replication has a much smaller proportionate impact to publishing
every hour and adding 8 hours. 
It would be very useful for the CA to include a hint of the publication
period so the client can make an informed judgment when to look for a new
CRL. An integer representing the number of minutes for the publication
period or a Generalised time value for the expected publication time would
be a good candidates.