Re: [dnsext] RRSIG signer name down-casing

[Edward Lewis <[e-mail]>]

At 8:57 +0100 6/21/11, George Barwood wrote:

>It seems that the signer name has to be down-cased for this 
>signature to verify.
>
>However this is contrary to 
>http://tools.ietf.org/html/draft-ietf-dnsext-dnssec-bis-updates-12#section-5.1
>
>    When canonicalizing DNS names, DNS names in the RDATA section of NSEC
>    and RRSIG resource records are not downcased.
>
>But existing validators don't fail, so it seems they do down-case.
>
>Hence I'm confused. Is dnssec-bis-updates "wrong"?

This discussion came up recently on some list.  The answer is that 
the case doesn't matter, uh, in this case.  The only time a domain 
name in the RDATA has to be down cased is when it can be compressed.

The reason is - without compression, the RR will appear in a response 
the same as it was generated (outside of forgeries, which is what 
DNSSEC is about).  With compression, the case used for the domain 
name in the RDATA depends on what comes first in the response.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

I'm overly entertained.