Re: [dnsext] Related to section 5.1 of dnssec-bis-updates (-14)

In message <4F13F208.8010908@nlnetlabs.nl>, "W.C.A. Wijngaards" writes:
> Hi Mark,
> 
> On 01/13/2012 11:50 PM, Mark Andrews wrote:
> >>> I don't recall seeing much discussion of the below. =A0As doc
> >>> editor, I would
> >>> like to hear an extra voice or three chime in before I fix
> >>> this.
> >>> 
> >>> As I understand Ed's message, the (signer) name in an RRSIG
> >>> does need to be downcased. 
> >>> The next name in a NSEC RR does NOT need to be downcased. Is
> >>> that right?
> >> +1. Sometime back there was an email thread (which I can't locate
> >> now) where the signature verification failed if you don't
> >> downcase for something in .US zone.
> > 
> > named downcases the RRSIG's Signer's Name named does not downcase
> > NSEC's Next Domain Name.
> 
> unbound does not downcase RRSIG signername and does not downcase NSEC
> nextdomain name for DNSSEC validation.

Then how does it validate .US, .CO and .BIZ as the signer in the RRSIG
is in upper case?  If I disable down casing I get validation failures.

17-Jan-2012 14:48:21.099 validating @0x101101c00: US DNSKEY: no valid signature found
17-Jan-2012 14:48:22.062 error (insecurity proof failed) resolving 'US/DNSKEY/IN': 156.154.127.70#53
17-Jan-2012 14:48:22.430 validating @0x101101c00: US DNSKEY: no valid signature found
17-Jan-2012 14:48:22.430 error (no valid RRSIG) resolving 'US/DNSKEY/IN': 156.154.126.70#53
17-Jan-2012 14:48:22.735 validating @0x101101c00: US DNSKEY: no valid signature found
17-Jan-2012 14:48:22.735 error (no valid RRSIG) resolving 'US/DNSKEY/IN': 209.173.58.70#53
17-Jan-2012 14:48:23.963 validating @0x101112e00: US DNSKEY: no valid signature found
17-Jan-2012 14:48:23.963 error (no valid RRSIG) resolving 'US/DNSKEY/IN': 156.154.125.70#53
17-Jan-2012 14:48:24.273 validating @0x101112e00: US DNSKEY: no valid signature found
17-Jan-2012 14:48:24.273 error (no valid RRSIG) resolving 'US/DNSKEY/IN': 156.154.124.70#53
17-Jan-2012 14:48:25.502 validating @0x101100c00: US DNSKEY: no valid signature found
17-Jan-2012 14:48:25.502 error (no valid RRSIG) resolving 'US/DNSKEY/IN': 156.154.128.70#53

> ldns rr canonicalisation does not downcase RRSIG signername and NSEC
> nextdomain.  So, this is for ldns-signzone and verify.
> 
> opendnssec produces lowercase signernames in its RRSIGs, and thus it
> does not matter if they are downcased or not (for the RRSIGs produced
> by the opendnssec signer).
> 
> It started with HINFO, where, today, the rdata is not downcased by
> unbound, ldns.
> 
> Best regards,
>    Wouter

It would be easy enough to have the validation routines try "as is"
then "lowercase" for backwards compatibility with the expectation
that we can look to removing backwards compatibility hacks Jan 1,
2020.  Similarly we would lowercase the signer when generating the
RRSIG and stop doing that around 2020.  That's 8 years to remove
the old validators.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext