Subject: Huge CRLs

From: Martin Lindström <[email-masked]>
Date: Thu, 09 Sep 1999 16:53:10 +0200

I have been searching the PKIX RFCs and X.509 standard for
a text that mandates something like:
"A certificate that has revoked should only have an entry in a
 CRL as long as its validity period indicates that it has not
 expired"
...but I haven't been able to find it.

Given the problem with CRL scalability, things get even worse
if some CAs issue CRLs with entries that point at already invalid
certificates. If a system needs the possibility to verify certificates
back in time, shouldn't the CRLs be archived instead of getting
larger and larger?

Comments?

/Martin Lindström

______________________________________
         Entegrity Solutions

  Martin Lindström
  Systems Designer 

  Finlandsgatan 60 
  S-164 74 Kista, Sweden
  Direct: +46-(0)8-477-7735
  Fax:    +46-(0)8-477-7731
  Cell:   +46-(0)70-483-0024
______________________________________