Re: [dnsext] Related to section 5.1 of dnssec-bis-updates (-14)

[Mohan Parthasarathy <[e-mail]>]

On Thu, Jan 12, 2012 at 8:20 PM, Samuel Weiler <[e-mail]> wrote:
> I don't recall seeing much discussion of the below.  As doc editor, I would
> like to hear an extra voice or three chime in before I fix this.
>
> As I understand Ed's message, the (signer) name in an RRSIG does need to be
> downcased.  The next name in a NSEC RR does NOT need to be downcased.  Is
> that right?
+1. Sometime back there was an email thread (which I can't locate now)
where the signature verification failed if you don't downcase for
something in .US zone.

-mohan

>
>
> On Thu, 13 Oct 2011, Edward Lewis wrote:
>
>> In this section of the still-a-draft update to the DNSSEC definition of
>> RFC 4033-4035 an issue has arisen that needs to be addressed.
>>
>> # http://tools.ietf.org/html/draft-ietf-dnsext-dnssec-bis-updates-14
>> #
>> #5.1.  Errors in Canonical Form Type Code List
>> #
>> #   When canonicalizing DNS names, DNS names in the RDATA section of NSEC
>> #   and RRSIG resource records are not downcased.
>> #
>> #   [RFC4034] Section 6.2 item 3 has a list of resource record types for
>> #   which DNS names in the RDATA are downcased for purposes of DNSSEC
>> #   canonical form (for both ordering and signing).  That list
>> #   erroneously contains NSEC and RRSIG.  According to [RFC3755], DNS
>> #   names in the RDATA of NSEC and RRSIG should not be downcased.
>> #
>> #   The same section also erroneously lists HINFO, and twice at that.
>> #   Since HINFO records contain no domain names, they are not subject to
>> #   downcasing.
>>
>> For the purposes of this email a "major implementation" refers to a widely
>> distributed general purpose implementation of DNS.  It's become apparent
>> that two major implementations of validators have differed on downcaseing
>> the RRSIG.
>>
>> We've been trying to determine why this problem hasn't surfaced in a
>> real-world outage.  It seems that all major implementations of signers down
>> case
>> the RRSIG before signing.
>>
>> Treat this as a suggestion.  Unexcuse RRSIG from the list of names that
>> avoid downcasing.  (NSEC is not a problem.)  Any thoughts?
>>
>> --
>>
>> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
>> Edward Lewis
>> NeuStar                    You can leave a voice message at
>> [phone]
>>
>> Vote for the word of the day:
>> "Papa"razzi - father that constantly takes photos of the baby
>> Corpureaucracy - The institution of corporate "red tape"
>>
>
> _______________________________________________
> dnsext mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsext
>