Re: WGLC: draft-ietf-dnsext-nsec3-09

[Roy Arends <[e-mail]>]

Peter Koch <[e-mail]> wrote on 02/21/2007 09:07:13 PM:

> Dear Roy,
> 
> thanks for your detailed reply.
> 
> > > >    special case: NSEC3 ownernames cannot be proven to exist, in 
> > general.
> > > 
> > > Isn't that "_can_ be proven _not_ to exist"?
> > 
> > NSEC3 ownernames cannot be proven to exist. Proof of existence of an 
NSEC3 
> > ownername requires another NSEC3 record, which makes this a recursive 
> > problem.
> 
> Proof of existence usually is neither necessary nor a goal because it 
happens
> implicitly by having a (signed) RRSet for a name.

Yes. Also explicitly by having a signed NSEC or NSEC3 for a name.

> Seems we have a before-after
> problem here: you're saying it can't be proven, "because of the 
following"?

I don't get it. Sorry.
 
> > Multiple NSEC3 chains are allowed. Not sure what you mean by parallel.
> 
> Both chains are full loops, independent of each other (hopefully 
consistent,
> though).

Yes.

> > > The current text also
> > > clarifies 4034 (references to 2929 etc), so is this meant to update 
> > 4034?
> > 
> > I don't know what you mean.
> 
> The text is no verbatim copy of what appeared in RFC 4034, but it is 
more
> clear. Should one assume that this clarification now also applies to the
> NSEC spec in 4034?

Yes.

> > > > 4.  The NSEC3-Parameters Resource Record
> > > 
> > > >    If an NSEC3PARAM RR is present at the apex of a zone with a 
Flags
> > > >    Field value of zero, then there MUST be an NSEC3 using the same
> > > >    parameters present at every hashed ownername in the zone.  That 
is,
> > > >    the zone MUST contain a complete set of NSEC3 RRs with the 
same,
> > > >    indicated parameters.
> > > 
> > > It took me some time to read "every hashed ownername" in a way that
> > > does not preclude Opt-Out. I think it's important to emphasize that
> > > NSEC3PARAM may only be present if there's a full loop of NSEC3 RRs.
> > 
> > We state 'complete set of NSEC3 RRs with..."
> 
> Yes, but "the same parameters" seemed to preclude flags!=0.

Ah. Will fix.
 
> > > > 5.  Calculation of the Hash
> > > > 
> > > >    The hash calculation uses three of the NSEC3 RDATA fields: Hash
> > > >    Algorithm, Salt, and Iterations.
> > > 
> > > s/NSEC3/NSEC3 and NSEC3PARAM/
> > 
> > No. Why ?
> 
> Well, isn't the info in NSEC3PARAM used by the server to locate the 
NSEC3?

This section is general, i.e. this algorithm is also used by the validator 
and the signer (both entitities that need not know about NSEC3PARAM).

Roy

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>