Subject: [dnsext] An 5155 inconvenience

From: Matthijs Mekking <[email-masked]>
Date: Fri, 20 Jan 2012 15:17:04 +0100

Hi,

Section 8.2 of RFC 5155 states that a validator MUST ignore NSEC3 RRs
with a Flag fields value other than zero or one. But in the IANA
Considerations section, bits 0-6 are available for assignment.

Could it be that Section 8.2 actually says that a validator MUST ignore
bit 0-6 of the NSEC3 Flags field? Do you think this clarification is
suitable for an errata or as text in dnssec-bis-updates?

Best regards,
  Matthijs

---

From: Edward Lewis <[email-masked]>
Date: Fri, 20 Jan 2012 09:30:16 -0500

My reading of this is - if a validator is built with RFC 5155 in mind 
and it sees an NSEC3 RR with a flag field "other than 0 or 1" the 
record has been created by a signer that conforms to a more modern 
specification, say, RFC 17234.  (Or the signer is buggy, etc.)  As 
such, the validator is not equipped to deal with the situation and 
should complain somehow instead of proceeding.

At 15:17 +0100 1/20/12, Matthijs Mekking wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Hi,
>
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.4.11 (GNU/Linux)
>Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
>iQEcBAEBAgAGBQJPGXdgAAoJEA8yVCPsQCW5BnQH/0AyeXy2MCilAfb3ZUM7JPZZ
>Ya6dYiWnyJo9xN9Y+iCDeKwmgkETT0xOfYyNoHgrN/7fmYsU/F0AERycfaqKkXhD
>xXoru5/D2t+YjdlpjsYN7CAIGkkwOcniXp4/vdA+m62fFCiC3Qavcml5P8+mKSoJ
>BQkDt9jU0o7Bm+MUu5AL2pzslxeROdODcOjhc/Qy9zg1lLvxCwZCpHwV0GfphFd3
>wcpstycYV7b8UYpWs36CqLgEy3lMKdNVElK7hLUmY03/n5tZ5kOxoGWxhN/Hm9TB
>tdQqzOn7hVS8BEn5tkrmdpLskjV4cq9VCAtmhYAWJscGIPhWiyH/iRcjIINqnu0=
>=ZXhb
>-----END PGP SIGNATURE-----
>_______________________________________________
>dnsext mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/dnsext

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

Vote for the word of the day:
"Papa"razzi - father that constantly takes photos of the baby
Corpureaucracy - The institution of corporate "red tape"

---

From: Matthijs Mekking <[email-masked]>
Date: Fri, 20 Jan 2012 16:27:07 +0100

If bit 0-6 must be zero, what's the point of having them available for
assignment?

Best regards,
  Matthijs

On 01/20/2012 03:30 PM, Edward Lewis wrote:
> and it sees an NSEC3 RR with a flag field "other than 0 or 1" the record
> has been created by a signer that conforms to a more modern
> specification, say, RFC 17234.  (Or the signer is buggy, etc.)  As such,
> the validator is not equipped to deal with the situation and should
> complain somehow instead of proceeding.
>

---

From: Edward Lewis <[email-masked]>
Date: Fri, 20 Jan 2012 10:32:54 -0500

Read it as:

MUST BE zero for the purposes of "conformance" to RFC 5155.
And/but we are open to future updates.

At 16:27 +0100 1/20/12, Matthijs Mekking wrote:
>iQEcBAEBAgAGBQJPGYfKAAoJEA8yVCPsQCW5XzAH/A6SoczYxU1FCMynyQSZPzvT
>6nXtA89SYsB1dmEB3QRfVONmhXaRI2Ahzcvc5oqUtiMOXuFCC5Dqtu5TadKsU/+m
>tJv6qeUrzeqBBAjl3MmRno8wPfoCbSoQHc+H9jTCOIlDrGPaauiBVowg4zjES9eK
>TecyfsSrSfzmGseodp/PAXZf6fJgvFFeDRusdA8gL20P0TUzsyMB+AbvBTdfs3xk
>ZkMJx0xWm96rSSVtvx/CwMD4cjyQyMh/2gjHwKQZRbFiyetEgcJf2D+70TmEaPGp
>Y+eZ3p9CkbHB422sAk94zkhjffq/DyFjc5IiNuKlDApGuMwbW+c6jtrVGjCvbsk=
>=yHM2

---

From: Ben Laurie <[email-masked]>
Date: Fri, 20 Jan 2012 15:34:55 +0000

> If bit 0-6 must be zero, what's the point of having them available for

If they were not forced to some known state before assignment, then
they would not be available!