Re: Why is the crlNumber an OCTET STRING?

On 20 Apr 2021, at 15:04, Russ Housley wrote:

> I do not read it that way at all.  It is saying that relying parties 
> need to the able to handle INTEGER values that are up to 20 octets in 
> size.  Of course RSA keys use INTEGER values that are much bigger than 
> that.  And, the text explains there are various ways that a CRL issuer 
> can assign numbers for different scopes that can lead to larger 
> values.

I do not see how the text says that, and am concerned that you do. Are 
you saying that an CRL issuer can pick an initial number for the scope 
that is large? If so, where in 5280 (or somewhere else) does it say 
that?

--Paul Hoffman