Re: [dnsext] Related to section 5.1 of dnssec-bis-updates (-14)

[Samuel Weiler <[e-mail]>]

I don't recall seeing much discussion of the below.  As doc editor, I 
would like to hear an extra voice or three chime in before I fix 
this.

As I understand Ed's message, the (signer) name in an RRSIG does need 
to be downcased.  The next name in a NSEC RR does NOT need to be 
downcased.  Is that right?

On Thu, 13 Oct 2011, Edward Lewis wrote:

> In this section of the still-a-draft update to the DNSSEC definition of RFC 4033-4035 an issue has arisen that needs to be addressed.
> 
> # http://tools.ietf.org/html/draft-ietf-dnsext-dnssec-bis-updates-14
> #
> #5.1.  Errors in Canonical Form Type Code List
> #
> #   When canonicalizing DNS names, DNS names in the RDATA section of NSEC
> #   and RRSIG resource records are not downcased.
> #
> #   [RFC4034] Section 6.2 item 3 has a list of resource record types for
> #   which DNS names in the RDATA are downcased for purposes of DNSSEC
> #   canonical form (for both ordering and signing).  That list
> #   erroneously contains NSEC and RRSIG.  According to [RFC3755], DNS
> #   names in the RDATA of NSEC and RRSIG should not be downcased.
> #
> #   The same section also erroneously lists HINFO, and twice at that.
> #   Since HINFO records contain no domain names, they are not subject to
> #   downcasing.
> 
> For the purposes of this email a "major implementation" refers to a widely distributed general purpose implementation of DNS.  It's become apparent
> that two major implementations of validators have differed on downcaseing the RRSIG.
> 
> We've been trying to determine why this problem hasn't surfaced in a real-world outage.  It seems that all major implementations of signers down case
> the RRSIG before signing.
> 
> Treat this as a suggestion.  Unexcuse RRSIG from the list of names that avoid downcasing.  (NSEC is not a problem.)  Any thoughts?
> 
> -- 
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> Edward Lewis             
> NeuStar                    You can leave a voice message at [phone]
> 
> Vote for the word of the day:
> "Papa"razzi - father that constantly takes photos of the baby
> Corpureaucracy - The institution of corporate "red tape"
> 
>

_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext