Re: Why is the crlNumber an OCTET STRING?

Stefan Santesson <[email protected]> writes:

>I have done quite some PKI validation implementations, but I have never found
>any reason yet to check the CRL number for any reason what so ever.

Same here, could never figure out what the purpose of it was.  Russ' answer
about partitioned CRLs makes sense, but I'd never even considered that
because, like delta CRLs, I've never encountered anyone brave enough to want
to see what clients do in response to seeing one.

>When I do CRL checking, I download the current CRL, check that it is current
>and still valid, and has the intended scope.
>
>No more, and no less. CRL number is not part of that process.

Yup.

>So basically, I find this interesting intellectually, but in what practical
>context does this matter?

I've got a client who asked about it, and my response of "I have no idea what
purpose these things serve" was possibly a bit underwhelming :-).

Peter.