Subject: Delta CRL Distribution Points

From: Trevor Freeman <[email-masked]>
Date: Wed, 29 Sep 1999 12:17:06 -0700

I have been looking at the Delta CRL section of 2459 as well as the latest
X.509 FPDAM, and have a number of issues. So the mail threads don't get
confusing, I will try to confine each mail to a single topic.
To implement Delta CRL's, you would need to add a mechanism to 2459 as to
how\where a client finds a delta CRL. The PDAM defines two mechanisms, one
of which (Freshest CRL) has the same ASN as an existing 2459 extension
(CDP). I propose we include the Freshest CRL in the revised 2459 as the
method to defining the Delta CRL distribution point. This extension could be
used in both the certificate and the CRL itself. My view is that we should
recommend that the extension be used in the CRL itself and that the
extension should only contain the list of general names i.e. no other
qualifiers. This gives a very simple relationship between the base and delta
CRL. If you have already partitioned the base CRL, I don't see much
advantage in partitioning the delta as well.
Trevor

---

From: "Phillip M Hallam-Baker" <[email-masked]>
Date: Wed, 29 Sep 1999 16:12:45 -0400

This is a good point. The FPDAM provides a lot of rope in the CRL area,
it is probably inadvisable to use all of it. On the other hand I see
considerable disadvantages to forbidding use of all of it!

As I see it delta CRLs, and the various scope mechanisms (serial numbers,
CDPs) have a certain degree of overlap. Certainly scopes and delta CRLs
are both a means of keeping the size of the CRL manageable.

I agree that using these mechanisms in conjunction would be complex in
practice. I am not sure that using scopes and delta CRLs is considerably
more complex than delta CRLs alone but it would certainly be a defensible
implementation decision to allow use of one mechanism or the other but
not both.

On the other hand some folk might argue that prohibiting use of both
mechanisms together would introduce complexity. This was the reason
why I raised no objection to the extension of OCDP to cover delta
CRLs.

[Note: in order to avoid starting another CRL arguing match I should
frame the discussion bellow by pointing out that the issues of scale
which I refer to are on the order of 1 million to 1 billion certs.]

I believe that the root of the complexity in this case is attempting to
manage a situation where multiple signed documents issued at different
times must be combined to validate a certificate. This is an intrinsic
problem with both Delta CRLs and Paul Kocher's CRTs. If the voulme of
updates becomes large there is a scalability problem which manifests
itself as a reliability issue as opposed to a performance issue.

[Similar objections were raised when I proposed that the meta-CRLs of
OCDP be infinitely recursive, a proposal which was sensibly reduced
to a comment made for prior art purposes in the public OCDP draft. This
is why the stacking depth of OCDP CRLs was limited to 2!]

Given this intrinsic complexity issue one might well regard the use of
scopes as essential if a large system were to be deployed using delta
CRLs.

I don't see that we need to take a decision on this in PKIX at this point
however. Certainly not until the FPDAM is voted on.

		Phill

> -----Original Message-----
> From: Trevor Freeman [mailto:[email-masked]]
> Sent: Wednesday, September 29, 1999 3:17 PM
> To: Pkix List (E-mail)
> Subject: Delta CRL Distribution Points
>
>