Re: [pkix] Why is the crlNumber an OCTET STRING?

[Stephen Farrell <[e-mail]>]

Hiya,

On 21/04/2021 16:20, Peter Gutmann wrote:
> Just noticed that the RFC text kinda confirms this:

That sounds reasonable - simplest explanation being most
likely and all that:-)

> 
>     As noted in Section 4.1.2.2, serial numbers can be expected to
>     contain long integers.  Certificate users MUST be able to handle
>     serialNumber values up to 20 octets in length.  Conforming CAs MUST
>     NOT use serialNumber values longer than 20 octets.
> 
>     As noted in Section 5.2.3, CRL numbers can be expected to contain
>     long integers.  CRL validators MUST be able to handle cRLNumber
>     values up to 20 octets in length.  Conforming CRL issuers MUST NOT
>     use cRLNumber values longer than 20 octets.
> 
> So it's a cut&paste of the text for certificate serial numbers, for which
> there's a legitimate reason, the German tank problem, to not use actual serial
> numbers.

IIRC there was also a request from a CA in .au around then
that used company registration numbers as (part of?) the
cert serial number and those were long structured numbers or
something. I vaguely recall being asked to get text in that
alerted people that serials could be longer than some
implementations expected at that time.

I've no recollection of how the CRL number text ended up the
same.

Cheers,
S.