RE(2): operational protocols

[<[e-mail]>]

         Late into this thread as usual, but can anyone tell me why
         the CIL works at all? Why couldn't the bad Directory supply the
         caller with an old CIL ("I didn't get the latest CIL either")?
         
         My impression of the (maybe partial) solution to the "I didn't get
         it" problem was that a policy is defined on CRL update releases. 
         One release is defined to be expected every X days. This policy
         can be specified in a V3 certificate. If the CA has nothing to 
         say on a particular CRL issue time point it issues an empty one,
         or a copy of the previous one, depending on whether delta CRLs
         are being used.
         
         Under the policy described above, Validation of a certificate
         demands that all current CRLs, including empty ones have been 
         looked at. If a Directory says "didn't get the last issue", and 
         note that it can't hide the fact that there should be one,
         then the policy says the certificate cannot be treated as valid.
         You can't stop the denial of service threat but you can stop 
         revoked certificates being accepted.
         
         Tom Parker
         ICL, UK
         7.4.97