[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Two questions on delta-CRL
In section 5.2.4 (Delta CRL Indicator), RFC 2459 states:
The delta CRL indicator is a critical CRL extension that identifies a
delta-CRL. The use of delta-CRLs can significantly improve
processing time for applications which store revocation information
in a format other than the CRL structure. This allows changes to be
added to the local database while ignoring unchanged information that
is already in the local database.
When a delta-CRL is issued, the CAs MUST also issue a complete CRL.
(...) Again, a delta-CRL MUST NOT be issued without a corresponding
complete CRL.
The two questions are the following:
1) What is the rational for mandating the issuance of a complete CRL each
time a delta-CRL is issued ?
2) Under which conditions could this requirement be relaxed ?
Denis