Re: [dnsext] RRSIG signer name down-casing

On Tue, Jun 21, 2011 at 6:38 AM, Edward Lewis <Ed.Lewis@neustar.biz> wrote:

> At 8:57 +0100 6/21/11, George Barwood wrote:
>
>  It seems that the signer name has to be down-cased for this signature to
>> verify.
>>
>> However this is contrary to http://tools.ietf.org/html/**
>> draft-ietf-dnsext-dnssec-bis-**updates-12#section-5.1<http://tools.ietf.org/html/draft-ietf-dnsext-dnssec-bis-updates-12#section-5.1>
>>
>>   When canonicalizing DNS names, DNS names in the RDATA section of NSEC
>>   and RRSIG resource records are not downcased.
>>
>> But existing validators don't fail, so it seems they do down-case.
>>
>> Hence I'm confused. Is dnssec-bis-updates "wrong"?
>>
>
> This discussion came up recently on some list.  The answer is that the case
> doesn't matter, uh, in this case.  The only time a domain name in the RDATA
> has to be down cased is when it can be compressed.
>
> The reason is - without compression, the RR will appear in a response the
> same as it was generated (outside of forgeries, which is what DNSSEC is
> about).  With compression, the case used for the domain name in the RDATA
> depends on what comes first in the response.
>
> I am a little confused about this. As per RFC 4034, the signer name cannot
be compressed and for signature calculation it should be lower case. So, it
is possible that the received RRSIG has "ORG" in the signer name whereas the
signature was computed with "org" ?

> --
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=**-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=**
> -=-=-=-=-=-=-=-
> Edward Lewis
> NeuStar                    You can leave a voice message at
> +1-571-434-5468
>
> I'm overly entertained.
>
> ______________________________**_________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/**listinfo/dnsext<https://www.ietf.org/mailman/listinfo/dnsext>
>

-- 
Sean