Subject: Re: Huge CRLs

From: Keith Brady <[email-masked]>
Date: Thu, 09 Sep 1999 20:39:19 +0100

"Martin" == Martin Lindström <[email-masked]> writes:

Martin> certificates. If a system needs the possibility to verify
Martin> certificates back in time, shouldn't the CRLs be archived instead
Martin> of getting larger and larger?

Unfortunately, of course one can end up with an ever increasing collection
of CRLs. I believe the reason the behaviour is unspecified is that it is
left up to the CA policy to decide what it does with expired certs in this
case. I believe most current implementations act as you suggest.

Worse is that, arguably, one would have a multi-valued CRL attribute in a
directory with the historical CRLs retained there but no way of selecting
only the attribute value corresponding to the current CRL. This would, of
course cause the same problem that excluding expired certs was meant to
solve.

cheers,

Keith

--
Keith Brady,                                    Phone: +353-(1)-6477300 
Baltimore Technologies,                           Fax: +353-(1)-6477499
61-62 Fitzwilliam Lane,                      <http://www.baltimore.com>
Dublin 2, Ireland

--
Company Standard Disclaimer
--------------------------------------------------------------------------
The information contained in this message is confidential and is intended
for the addressee(s) only. If you have received this message in error or
there are any problems please notify the originator immediately. The
unauthorised use, disclosure, copying or alteration of this message is
strictly forbidden. This message and any attachments have been scanned for
viruses. Baltimore Technologies plc will not be liable for direct,
special, indirect or consequential damages arising from alteration of the
contents of this message by a third party or as a result of any virus
being passed on.
--------------------------------------------------------------------------