RE: Cached OCSP responses vs. single entry CRLs

["Ryan M. Hurst" <rmh@xxxxxxxxxxxxxxxxxxxxx>]

Carl there are a number of reasons, one of the most significant being
backwards compatibility; many existing client implementations do not
support partitioned CRLs and there is not way to tell from a CDP if the
data on the other end represents a partitioned CRL or a full one.

Additionally there are commercial OCSP responders out there that support
this concept, yet very few CAs support the use of portioned CRLs to that
granularity.

Ryan

-----Original Message-----
From: owner-ietf-pkix@xxxxxxxxxxxx [mailto:owner-ietf-pkix@xxxxxxxxxxxx]
On Behalf Of Carl Wallace
Sent: Friday, December 05, 2003 1:09 PM
To: ietf-pkix@xxxxxxx
Subject: Cached OCSP responses vs. single entry CRLs


Why use OCSP to convey pre-produced revocation information in the way
that's
being discussed?  Why not use single entry CRLs?  The functionality is
similar and they could be propagated using existing technology (e.g.
directories, 3280 compliant path processing clients, etc.).