Why is the crlNumber an OCTET STRING?
Peter Gutmann <[email protected]>
| Newsgroups | gmane.ietf.x509 |
|---|---|
| Message-ID | <[email protected]> |
This came up recently in an implementation, the crlNumber, defined as "a monotonically increasing sequence number for a given CRL scope and CRL issuer", is defined in RFC 3280 (but not the original 2459) as "CRL numbers can be expected to contain long integers. CRL verifiers MUST be able to handle CRLNumber values up to 20 octets", i.e. a SHA-1 hash disguised as an INTEGER. So if it's a monotonically increasing sequence number, why is it also a SHA-1 hash? How can a CA issue several billion CRLs/delta CRLs to overflow an actual integer? Peter.