Re: [dnsext] downcasing of names in IPSECKEY and HIP?

[Edward Lewis <[e-mail]>]

At 22:18 +1100 2/23/12, Mark Andrews wrote:
>  Peter van Dijk writes:
>>  Dear colleagues,
>>
>>  working from dnssec-bis-updates-16 section 5.1, and 6.2 of 4034, I 
>>gather tha
>>  t the rule for downcasing names in RDATA is not simply "downcase 
>>everything t
>>  hat is a name", but that the RRtypes listed have been selected for a reason.
...
>>  My apologies if answers to these questions are in the archives; I 
>>did a curso
>>  ry search but did not find anything.
>
>The answers are in the RFCs.  http://www.ietf.org/rfc/rfc3597.txt

Except that the RFCs aren't clear and contradict themselves.  I'm 
responding because I spent a non-trivial amount of time on this very 
topic sometime last year.

The general rule is supposed to be: if the type is compressible any 
domain name in the RDATA has to be downcased when doing DNSSEC 
operations (signing, validating).  That is because the case of the 
domain name might change due to the order of the response packet and 
the extent to which the sender tries to maintain case.

But, mistakes were made.  Compression was defined early.  A problem 
arose when new types, those in 1183 and later, were defined and 
implementers assumed that these new types should be compressed.  The 
reason they shouldn't was related to backwards compatibility, but 
that wasn't seen as a crucial design goal at the time.  Because some 
implementations of types defined in this "era" compressed the names, 
today we say "be prepared to see these compressed but don't compress 
them anymore."  Hence, down casing is needed.

And then there's the most frustrating case of the RRSIG.  Although it 
was defined after the new enlightenment that new types should not be 
compressed, the leading implementation continued to down case the 
type by mistake.  Kind of illustrating that code beats specification, 
other implementations followed the leading implementation and not the 
specification.  To this day, if you don't down case RRSIG there will 
likely be interoperability problems with your implementation.

 From my spreadsheet, the following type codes are to be down cased for DNSSEC:

2-9,12,14,15,17,18,21,24,26,30,33,35,36,38,39,46.
(Some of those are obsolete.)

The types that are to be compressed on sending and might (will) be on 
receiving:

2-9,12,14,15.

These are in the "well-known" range, those defined in STD 13 documents.

Types not to be compressed when sending but might be on receiving:

17,18,21,24,26,30,33,35.

The other types, 36, 38, 39, 46 are KX, A6, DNAME, and RRSIG.  Except 
for RRSIG, these were simply erroneously defined as needing to be 
down cased from the start.

As far as I can tell...
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

2012...time to reuse those 1984 calendars!
_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext