Re: [DNSOP] New Version Notification for draft-sury-deprecate-obsolete-resource-records-00.txt

[Richard Gibson <[e-mail]>]

TSIGs cover "A whole and complete DNS message in wire format, before the 
TSIG RR has been added to the additional data section and before the DNS 
Message Header's ARCOUNT field has been incremented to contain the TSIG 
RR" (RFC 2845 section 3.4.1), and would therefore be sensitive to 
decompression.


On 03/26/2018 11:33 AM, Michael Casadevall wrote:
> 2. Resolvers MUST never generate obsolete RRtypes in a compressed
> format. If (in line with below) the resolver receives a record in
> compressed form, it MUST be decompressed before being sent to downstream
> resolvers as though. Resolvers SHOULD warn that they are unpacking
> records in transit.
>
> How's that sound? I'm still somewhat iffy on my understanding of DNSSEC
> RRSIG canonical forms, but if I understood the RFCs correctly, the
> uncompressed record should match the canonical form the RRSIG validates
> against to which in turn is identical to RFC 3597 (aside from WKS,
> although RFC 2136 suggests it only applies in the case of DNS update and
> not validation)
>
> It specifically states you're allowed to understand, but thou must not
> speak. If there's a DNSSEC concern, it should be noted though I don't
> think it's a showstopper in and of itself. As previously stated, I very
> much doubt these records are commonly if ever signed.