IETF Logo Mail Archive

Re: [dnsext] Related to section 5.1 of dnssec-bis-updates (-14)

"W.C.A. Wijngaards" <wouter@nlnetlabs.nl> Mon, 16 January 2012 09:47 UTC

Return-Path: <dnsext-bounces@ietf.org>
X-Original-To: namedroppers-archive-gleetwall6@lists.ietf.org
Delivered-To: ietfarch-namedroppers-archive-gleetwall6@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87DE421F858E; Mon, 16 Jan 2012 01:47:02 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1326707222; bh=Qa/9xXNSVC1UqI7ZMu3ow8qLifw9CXfqsCkdYkJGMY8=; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Subject:List-Id:List-Unsubscribe:List-Archive:List-Post:List-Help: List-Subscribe:Content-Type:Content-Transfer-Encoding:Sender; b=jbY9tpVLPhLY4XiP5lGoyv/grq+3CaVX5OlzFY68g+KNQerWHn4WN6dB4LcRf3iDI OlHas/b9ssTkJsy6GGbRjzSQKaGMN4ibf61izfM3890UwF5FAf/FoRofr84w7bcs4M +OGDT/oh7lDD1CWns6p965oIaqcbsCA9X/v5BFek=
X-Original-To: dnsext@ietfa.amsl.com
Delivered-To: dnsext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA1FF21F858F for <dnsext@ietfa.amsl.com>; Mon, 16 Jan 2012 01:47:00 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kB1M0gNYtja0 for <dnsext@ietfa.amsl.com>; Mon, 16 Jan 2012 01:46:59 -0800 (PST)
Received: from open.nlnetlabs.nl (open.nlnetlabs.nl [IPv6:2001:7b8:206:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AB3021F858E for <dnsext@ietf.org>; Mon, 16 Jan 2012 01:46:59 -0800 (PST)
Received: from axiom.nlnetlabs.nl (axiom.nlnetlabs.nl [IPv6:2001:7b8:206:1:222:4dff:fe55:4d46]) (authenticated bits=0) by open.nlnetlabs.nl (8.14.4/8.14.4) with ESMTP id q0G9kmPP058012 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for <dnsext@ietf.org>; Mon, 16 Jan 2012 10:46:57 +0100 (CET) (envelope-from wouter@nlnetlabs.nl)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nlnetlabs.nl; s=default; t=1326707218; bh=k9HdKrZc4JhrZ+1YmWIwVlphQcnT57ebJEJ/U4SjNE8=; h=Message-ID:Date:From:MIME-Version:To:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=gSM1OQ9TSKhap7KMwhHlsn605D+qJnhERAaGVaEJu13q1vXPYGOmJ8lbgO8wMKaqP 8jZ+yR4bGHUh14ZYKFOBzsjljx4o8fQZSDpooakV5c45NFf0JuvrD6JI9MkudgBR4v R8MktjRNZDvvtZrsvQxaaTmwsGd6SQJnLXX1mFaI=
Message-ID: <4F13F208.8010908@nlnetlabs.nl>
Date: Mon, 16 Jan 2012 10:46:48 +0100
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:9.0) Gecko/20111222 Thunderbird/9.0
MIME-Version: 1.0
To: dnsext@ietf.org
References: <a06240801cabc9d0de24d@192.168.129.103> <alpine.BSF.2.00.1201122318080.86374@fledge.watson.org> <CACU5sDnPJxPqQJ455iDeyvLaABk0HUnvNh1aPeq21XQuevqKkg@mail.gmail.com> <20120113225013.642F21B13171@drugs.dv.isc.org>
In-Reply-To: <20120113225013.642F21B13171@drugs.dv.isc.org>
X-Enigmail-Version: 1.3.4
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7 (open.nlnetlabs.nl [IPv6:2001:7b8:206:1::53]); Mon, 16 Jan 2012 10:46:57 +0100 (CET)
Subject: Re: [dnsext] Related to section 5.1 of dnssec-bis-updates (-14)
X-BeenThere: dnsext@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: DNS Extensions working group discussion list <dnsext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsext>, <mailto:dnsext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsext>
List-Post: <mailto:dnsext@ietf.org>
List-Help: <mailto:dnsext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: dnsext-bounces@ietf.org
Errors-To: dnsext-bounces@ietf.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Mark,

On 01/13/2012 11:50 PM, Mark Andrews wrote:
>>> I don't recall seeing much discussion of the below. =A0As doc
>>> editor, I w=
>> ould
>>> like to hear an extra voice or three chime in before I fix
>>> this.
>>> 
>>> As I understand Ed's message, the (signer) name in an RRSIG
>>> does need to =
>> be
>>> downcased. =A0The next name in a NSEC RR does NOT need to be
>>> downcased. =
>> =A0Is
>>> that right?
>> +1. Sometime back there was an email thread (which I can't locate
>> now) where the signature verification failed if you don't
>> downcase for something in .US zone.
> 
> named downcases the RRSIG's Signer's Name named does not downcase
> NSEC's Next Domain Name.

unbound does not downcase RRSIG signername and does not downcase NSEC
nextdomain name for DNSSEC validation.

ldns rr canonicalisation does not downcase RRSIG signername and NSEC
nextdomain.  So, this is for ldns-signzone and verify.

opendnssec produces lowercase signernames in its RRSIGs, and thus it
does not matter if they are downcased or not (for the RRSIGs produced
by the opendnssec signer).

It started with HINFO, where, today, the rdata is not downcased by
unbound, ldns.

Best regards,
   Wouter
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPE/IDAAoJEJ9vHC1+BF+NVLIP/jnbdomYSCqaBF6tIuxofYDr
7oXI88Yb1yzrmW25rWmCQzZYQUknzGAvgxKzFzD3deZPiNyPKl9I+H42872U36k0
9pjsyqQ0QEwipUdl5ty+ieQrgZUGlsjLLevANeC2nB1Ic8jXsZ4w2KH74NRgDqNC
j+Y1vKUz8D1S8SvqoAPgScRsLTehR51JQ78Hb7UnBZ4e2qwrBygwaVOGrMM2n0aY
sYH4pI+3/VaB4JnSgxwp5SrLKRm8G09af1Rav6P/lMslAmS3Hksi21N8fNAG32n0
JwvhEZl9rT/oSjkF0FpxcN1+//yOFVNHNJxWFi7PxykNsGPfDaj6xWuN/xTj6r05
sIyT5idFS59asPXpORTK1AYLbLNWE6WMDHmTX/VWEF1dU/9VJCiBckUzOLl68+vs
fX7BAot5oEHX+s/Tk2md3AAM8XOXtntaZm1E8sZJ19hcBriquy675VEs76JD20QM
zoRqk+tAhviYwFb3t4aQJonP1WwnnebEMzc4nuZFFwnIeNJJy9TZU5u4oaMt/PQT
NsjKcHfjSmInyOmg0Jnd6lJp6p2flht66S0JnSb2ed+KZGG3w0IPKTN/9nS5AoaD
pAPoUyNrC1biw5vRy+kr5FO9ll+pIbJgLvKH93HYi7hSccxGlYdz0hFq5XEanFf7
Qrdx5BWFPHgaS17ciHr7
=TrdF
-----END PGP SIGNATURE-----
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext

v2.23.0 | Report a Bug | By Email