Re: [pkix] Why is the crlNumber an OCTET STRING?

[Russ Housley <[e-mail]>]

> On Apr 20, 2021, at 5:58 PM, Peter Gutmann <[e-mail]> wrote:
> 
> Russ Housley <[e-mail]> writes:
> 
>> I see nothing about an OCTET STRING ...
> 
> If it's 20 bytes it's an OCTET STRING dressed up as an INTEGER, not a real
> INTEGER.  In particular, if it's something where you'd need to issue 18
> quintillion, 446 quadrillion, 744 trillion, 73 billion, 709 million, 551
> thousand and 615 CRLs to exceed the capacity of an actual integer value
> (assuming 64-bit) then there's something else going on, which is what I was
> trying to find out.  It's not a "monotonically increasing sequence number" any
> more because it's not possible to issue that many CRLs, so what is it?

I do not read it that way at all.  It is saying that relying parties need to the able to handle INTEGER values that are up to 20 octets in size.  Of course RSA keys use INTEGER values that are much bigger than that.  And, the text explains there are various ways that a CRL issuer can assign numbers for different scopes that can lead to larger values.

Russ