Re: [Sidrops] what to do when the CRL is hosed?

[George Michaelson <[e-mail]>]

I believe while I may use sloppier language, in broad intent agree
with Steve.  There is information in a CRL which is not expressed in a
manifest. We added manifests to our system, we did not deprecate or
replace CRLs.

We did not design this PKI with intent to make CRL optional or
unnecessary, and the Manifest as I understand my recollections, was to
provide a statement of what MUST be seen, not to exclude any other
things existing, or to repudiate things. it is not "complete" as I
understand it, it is only a statement of things which should not be
missing. There can be other things. it is entirely possible
publication of the manifest is asynchronous to other publication
events, (large flat repositories) and so will not reflect fetch state,
but future manifest state will.

It is a mechanism to show if intermediates are attempting to hide
things. It is not a categorical statement that other things are
invalid or valid, because they can be cryptographically valid, not
expired, but repudiated by a CRL which you are not seeing.

If you cannot see a CRL which you are told should exist, to assume the
CRL doesn't matter feels extremely unwise. I may have mistakenly
published entirely cryptographically valid things which do not now
inform my intent, and I have tried to repudiate, and you cannot see
that repudiation and now interpret states of routing in ways which do
not reflect my true intent.

-George