Re: [IPsec] Comments to the draft-ietf-ipsecme-split-dns-04.txt

[Tero Kivinen <[e-mail]>]

Paul Wouters writes:
> > It is bit misleading to say that "Key Tag", "Algorithm", "DS algoritm"
> > etc can either be 0 or 2/1/1 etc octets long. How does the receiver
> > know what is going to be the length of the "Key Tag" value for
> > example?
> 
> It was actually a mistake (partially induced by my memory of rfc-8078
> work and its errata). Those fields are all fixed length. Only the digest
> itself is variable length, and as per 8078 errata, the shortest
> representation would be "00", so two octets.

That does not match the section 3.

I.e., in section 3 you have examples and text saying that initiator
will send empty INTERNAL_DNSSEC_TA attribute in CFG_REQUEST:

   To indicate support for DNSSEC, an initiator includes one or more
   INTERNAL_DNSSEC_TA attributes as defined in Section 4 as part of
   the CFG_REQUEST payload. If an INTERNAL_DNSSEC_TA attriute is
   included in the CFG_REQUEST, the initiator SHOULD also include one
   or more INTERNAL_DNS_DOMAIN attributes in the CFG_REQUEST.

   An initiator MAY convey its current DNSSEC trust anchors for the
   domain specified in the INTERNAL_DNS_DOMAIN attribute. If it does
   not wish to convey this information, it MUST use a length of 0.

but this is not possible with current definition of the section 4.2,
where the DNSKEY Key Tag etc fields are mandatory. Thats why my
proposal was to make whole DNSSEC Trust Anchor Data optional. 

> > I assume the intent has been to say that either all the fields are
> > there with fixed lengths, or they are all omitted, meaning the length
> > is 0 for all of them.
> 
> That was not at all the intent :)
> 
> I've submitted -05. My only question now is what to do with the
> length field of both records. It now says "2 octects, unsigned integer"
> but perhaps it should say "2 octets in network order" ?

In RFC7296 we have:

   All multi-octet fields representing integers are laid out in big
   endian order (also known as "most significant byte first", or
   "network byte order").

which covers everything. You could add similar text here... 
-- 
[e-mail]