Re: [dnsext] Related to section 5.1 of dnssec-bis-updates (-14)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Mark,

On 01/17/2012 05:06 AM, Mark Andrews wrote:
>>> named downcases the RRSIG's Signer's Name named does not
>>> downcase NSEC's Next Domain Name.
>> 
>> unbound does not downcase RRSIG signername and does not downcase
>> NSEC nextdomain name for DNSSEC validation.
> 
> Then how does it validate .US, .CO and .BIZ as the signer in the
> RRSIG is in upper case?  If I disable down casing I get validation
> failures.

I was wrong!  Looked into the wrong code (there is a (mostly harmless)
bug).  Unbound downcases the RRSIG rdata.  Unbound does not downcase
the NSEC rdata.

So, the deployed Unbound implements -16, and is compatible with BIND.
 Given this is the deployed code, the other arguments are perhaps moot.

Hence that US, CO and BIZ verify.  Thanks for that test.

> It would be easy enough to have the validation routines try "as
> is" then "lowercase" for backwards compatibility with the
> expectation that we can look to removing backwards compatibility
> hacks Jan 1, 2020.

My apologies for wrong information - unbound contains a bug on this
topic - but unbound indeed downcases the RRSIG signer name.  Hence
very strong workarounds are not necessary.

> Similarly we would lowercase the signer when generating the RRSIG
> and stop doing that around 2020.  That's 8 years to remove the old
> validators.

lowercase the signer when generating the RRSIG is a bit on the strict
generation of data perhaps.  Otherwise US. seems to work in practice.

So, in this situation I would recommend keeping -16 as is, and not
changing the situation because of deployed code and signed zones (US,
CO, BIZ).

Best regards,
   Wouter
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPFTl3AAoJEJ9vHC1+BF+NVZAQAJ0rVoG3RIpT6HCFOCw1Humh
ALOb5eGRAgGzTJw4p62/oZfKcM5Qm+gm4Y4y+X9AeP/N7yinmTtmmhXCoMLTGiN7
jV0cbK7/W1ZMKiEiRTFdne33SCufIz/madkM3S8/X8dX9zQ39qMfTlj63EUJXUah
dMCKEG00QwKmu6KQbaifsYARzArJpo/8Ia1dVlcuPRUqx2p6xkjJ3GHSSahPREs2
6E/WzdzXviws+EOcswdbweROAL1OS3BnD/RdNyfFIFbwKu6SRE4MMi/4HwZJ0H55
PfmQCa05enmV700tnN258t3RBKpLjroApzF12PBMM5g2HDm9Xdo+2QYqc909iPle
GfEEM1w3Xbt+eH01kyij4GhZOejmq6lvvED25a8dcdt6ECvfCmU06chrX/RvpKhu
UYluYF62URJaxjxIOz2gAqK9nbG9n0rfQ+DMJedGvqIIbmm87RyFKC1WM4dTBQ4/
XQJ9y2lVaIDtZyuQRREtUCrMI4RUOhuce0LEBfdcKskfzvNWMCEM2NturbiaPVBy
YlaEWa7krgJeEJ3aYobv4gBAJ/+nv+IV02e/nH2KSjruTrts2h327XRKqlE7IG/P
8D3mGJLUwQCjcxcJ1KmTFi1rSIMsC+EXW1vRSZfqroyqU9qso48Ujf3pZnqlt+Ts
MaQTmg2JYRo0QuZ4R49U
=at3P
-----END PGP SIGNATURE-----
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext