From nobody Thu Oct 8 20:46:50 2020 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C6923A1302 for ; Thu, 8 Oct 2020 20:46:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vF92j0SeBx3M for ; Thu, 8 Oct 2020 20:46:46 -0700 (PDT) Received: from mx.pao1.isc.org (mx.pao1.isc.org [149.20.64.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 759253A1300 for ; Thu, 8 Oct 2020 20:46:46 -0700 (PDT) Received: from zmx1.isc.org (zmx1.isc.org [149.20.0.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx.pao1.isc.org (Postfix) with ESMTPS id 2A6743AB0AA; Fri, 9 Oct 2020 03:46:45 +0000 (UTC) Received: from zmx1.isc.org (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTPS id 052F0160071; Fri, 9 Oct 2020 03:46:45 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTP id E85AA160073; Fri, 9 Oct 2020 03:46:44 +0000 (UTC) Received: from zmx1.isc.org ([127.0.0.1]) by localhost (zmx1.isc.org [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id Noqswj-3EzvW; Fri, 9 Oct 2020 03:46:44 +0000 (UTC) Received: from [172.30.42.67] (unknown [49.2.101.160]) by zmx1.isc.org (Postfix) with ESMTPSA id 8EBA6160071; Fri, 9 Oct 2020 03:46:43 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.7\)) From: Mark Andrews In-Reply-To: Date: Fri, 9 Oct 2020 14:46:36 +1100 Cc: Nick Johnson , dnsop WG Content-Transfer-Encoding: quoted-printable Message-Id: <2C2BC47E-4336-416F-9519-BF9EA7C0D31D@isc.org> References: To: Shumon Huque X-Mailer: Apple Mail (2.3445.9.7) Archived-At: Subject: Re: [DNSOP] What is the purpose of NSEC3 "closest encloser" proofs? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Oct 2020 03:46:48 -0000 Or to put it another way You can have a NSEC3 records that proves that a.b.c.example and = *.b.c.example don=E2=80=99t exists but the wildcard you need to be = checking is *.c.example when b.c.example does not exist or maybe even = *.example if c.example does not exist. Mark > On 9 Oct 2020, at 14:13, Shumon Huque wrote: >=20 > On Thu, Oct 8, 2020 at 10:38 PM Nick Johnson = wrote: >=20 > Let's use your example and say 'a.b.c.example' doesn't exist in the = zone example. >=20 > Let's also say the longest ancestor of this name that actually does = exist in the zone is 'c.example' (which could be an empty non-terminal = or not -- either way, it will have an NSEC3 record matching the hash of = the name). >=20 > The NXDOMAIN proof consists of: >=20 > ### Closest Encloser proof: > * the NSEC3 RR that matches the closest encloser name 'c.example' > * the NSEC3 RR that covers the next closer name 'b.c.example' >=20 > Right; what I don't follow is why the second of those two proofs isn't = sufficient. Doesn't that alone prove that a.b.c.example doesn't exist? >=20 > It does. But the first NSEC3 is required for two reasons: the NSEC3 = negative proof is defined in terms of finding the longest ancestor of = the qname that does not exist, and also because we need to prove that = the wildcard synthesis was not possible. Both those things require us to = compute the closest encloser first. >=20 > Shumon. >=20 > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop --=20 Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org