Why is the crlNumber an OCTET STRING?

Peter Gutmann <[email protected]>
Newsgroups gmane.ietf.x509
Message-ID <[email protected]>
This came up recently in an implementation, the crlNumber, defined as "a
monotonically increasing sequence number for a given CRL scope and CRL
issuer", is defined in RFC 3280 (but not the original 2459) as "CRL numbers
can be expected to contain long integers.  CRL verifiers MUST be able to
handle CRLNumber values up to 20 octets", i.e. a SHA-1 hash disguised as an
INTEGER.

So if it's a monotonically increasing sequence number, why is it also a SHA-1
hash?  How can a CA issue several billion CRLs/delta CRLs to overflow an
actual integer?

Peter.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.