Subject: [dnsext] Problem with draft-ietf-dnsext-dnssec-bis-updates-19

From: Ben Laurie <[email-masked]>
Date: Mon, 8 Oct 2012 14:38:25 +0100

http://tools.ietf.org/html/draft-ietf-dnsext-dnssec-bis-updates-19#section-5.1
says

"When canonicalizing DNS names (for both ordering and signing), DNS
   names in the RDATA section of NSEC resource records are not
   downcased.  DNS names in the RDATA section of RRSIG resource records
   are downcased."

This appears to be true, but it caused us some confusion: DNS names in
NSEC _are_ still downcased for ordering purposes, and need to be or
there's not much point in NSEC.

It'd be nice you have a clarifying comment in 5.1...

BTW, at some point I appear to have fallen off this list, but not sure why...

---

From: Mark Andrews <[email-masked]>
Date: Tue, 09 Oct 2012 00:48:33 +1100

> there's not much point in NSEC.

Given that NSEC records are singletons there is nothing to order.
 
> _______________________________________________
> dnsext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsext
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Ben Laurie <[email-masked]>
Date: Mon, 8 Oct 2012 14:49:27 +0100

> Given that NSEC records are singletons there is nothing to order.

The owner and the next owner are ordered...

---

From: Mark Andrews <[email-masked]>
Date: Tue, 09 Oct 2012 02:04:11 +1100

In message <CABrd9SR1_m-8WEcCiu9v5SjT-vrrsZYA14SXq76eGUED=[email-masked]>
, Ben Laurie writes:
> >> http://tools.ietf.org/html/draft-ietf-dnsext-dnssec-bis-updates-19#section
> -5.
> >> 1
> >> says
> >>

But ordering of RDATA is to sort records in the RRset.

---

From: Ben Laurie <[email-masked]>
Date: Mon, 8 Oct 2012 16:55:57 +0100

> But ordering of RDATA is to sort records in the RRset.

I agree that you can pedant away the need for any statement, I am just
suggesting that it would be nice to avoid any doubt or confusion by
saying something about it. It certainly confused me when I first read
it.

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 8 Oct 2012 12:44:26 -0400

> saying something about it. It certainly confused me when I first read

Perhaps you could suggest text, because I'm still not clear on what
problem you think there is or why it needs to be added.  It appears
you didn't remain confused, so what is the issue?

A (as document shepherd)

-- 
Andrew Sullivan
[email-masked]

---

From: Ben Laurie <[email-masked]>
Date: Tue, 9 Oct 2012 11:40:28 +0100

> you didn't remain confused, so what is the issue?

The problem is that the text says "When canonicalizing DNS names (for
both ordering and signing)". NSEC involves an ordering step, which
this text appears to apply to. But it turns out not to. This wasted
considerable time figuring out what was going on.

So, one way to fix it could be to add:

"Note that NSEC records contain names ordered according to their
canonical form, even though they may appear in non-canonical form in
the NSEC RR."

IMO it would've been better to break those implementations that got
this wrong, rather than introduce this confusion, but whatever.