Re: Why is the crlNumber an OCTET STRING?

On Wed, Apr 21, 2021 at 4:19 PM Stefan Santesson <[email protected]> wrote:
>
> Yes, I understand the logic. I just say that as implementer I never
> found the reason to use this in practice.
>
> In practice I have a policy that test if my current cached CRL is valid
> to use. If yes, then I use it. if no, then I discard it and attempts to
> get a new CRL.
>
> The new CRL is treated the same way before being used.
>
> Perhaps my implementations are to simplistic, but I never found a
> compelling reason to check and compare CRL number.

It would make sense to use the existing CRL if the CRL has not changed
if it is expensive to download a CRL. The use case would include a
large PKI, like a federal PKI with a CRL that is hundreds of MB, and a
mobile client over 3G on a restrictive data plan.

Jeff