Re: [dnsext] [Technical Errata Reported] RFC4034 (2681)

[Olafur Gudmundsson <[e-mail]>]

This errata is also correct,
I ran into this same issue myself.


	Olafur


On 05/01/2011 5:18 PM, RFC Errata System wrote:
> The following errata report has been submitted for RFC4034,
> "Resource Records for the DNS Security Extensions".
>
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata_search.php?rfc=4034&eid=2681
>
> --------------------------------------
> Type: Technical
> Reported by: Guillaume Bailey<[e-mail]>
>
> Section: B
>
> Original Text
> -------------
>     The key tag is the same for all DNSKEY algorithm types except
>     algorithm 1 (please see Appendix B.1 for the definition of the key
>     tag for algorithm 1).  The key tag algorithm is the sum of the wire
>     format of the DNSKEY RDATA broken into 2 octet groups.  First, the
>     RDATA (in wire format) is treated as a series of 2 octet groups.
>     These groups are then added together, ignoring any carry bits.
>
>
> Corrected Text
> --------------
>     The key tag is the same for all DNSKEY algorithm types except
>     algorithm 1 (please see Appendix B.1 for the definition of the key
>     tag for algorithm 1).  The key tag algorithm is the sum of the wire
>     format of the DNSKEY RDATA broken into 2 octet groups.  First, the
>     RDATA (in wire format) is treated as a series of 2 octet groups.
>     These groups are then added together with at least 32-bit precision,
>     retaining any carry bits. The carry bits are then added to the result,
>     and finally, only the lower 16 bits of the result are used as the key
>     tag.
>
>
>
> Notes
> -----
> This change comes from the example implementation. The accumulator, ac, is required ("assumed") to be 32-bits or larger, and the carry bits are added to the accumulator before returning:
>
>      ac += (ac>>  16)&  0xFFFF;
>
> Instructions:
> -------------
> This errata is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party (IESG)
> can log in to change the status and edit the report, if necessary.
>
> --------------------------------------
> RFC4034 (draft-ietf-dnsext-dnssec-records-11)
> --------------------------------------
> Title               : Resource Records for the DNS Security Extensions
> Publication Date    : March 2005
> Author(s)           : R. Arends, R. Austein, M. Larson, D. Massey, S. Rose
> Category            : PROPOSED STANDARD
> Source              : DNS Extensions
> Area                : Internet
> Stream              : IETF
> Verifying Party     : IESG
>
>
>