Subject: zone-covering NSEC ranges -- "which is it?"

From: Paul Vixie <[email-masked]>
Date: Mon, 14 Jun 2004 21:08:36 +0000

i asked this in an earlier message but it was lost in the haze of a larger
discussion.  here are two NSEC RRs, more or less.

#1:          @ NSEC (SOA NS ...) @

#2:          X NSEC (...) X

there are two visible differences between them: one says there's an SOA and
NS at the ownername (@), the other does not (X).   and one's owner and target
names are "@" (the zone apex) and the other's owner and target name is "X"
(not the zone apex).

those familiar with the specs consider the first one to be a way of expressing
the nonexistence of any names other than the zone apex.  in other words it
covers the whole zone, all possible names.

why?  there are two possible answers.  for my own edification i'd like to
clarify which one applies, and for others' edification i might end up asking
that the dnssec-bis docset be amended to clarify this point.

the first possible answer to "why does @-NSEC-@ cover all possible names?"
is that the target name is @, and it's a special case indicating that all
names from the owner name through the end of the zone are in the range.

the second possible answer to "why does @-NSEC-@ cover all possible names?"
is that the target name equals the owner name, indicating a null range,
which in some kind of "serial number arithmetic" kind of way "wraps around."

if we select the first possible answer, then "X-NSEC-X" does not speak for
all possible names in the same way "@-NSEC-@" does.

if we select the second possible answer, then "X-NSEC-X", for any value of
X including @ or any other, speaks for all possible names.

which is it?

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Tue, 15 Jun 2004 09:53:49 +0200 (CEST)

On Mon, 14 Jun 2004, Paul Vixie wrote:

> > I had been assuming the second possible answer, given that RFC2535
> > said (5.1):
> >
> >    There is a potential problem with the last NXT in a zone as it
> >    wants to have an owner name which is the last existing name in
> >    canonical order, which is easy, but it is not obvious what name to
> >    put in its RDATA to indicate the entire remainder of the name
> >    space.  This is handled by treating the name space as circular and
> >    putting the zone name in the RDATA of the last NXT in a zone.
> >
> > However it appears that DNSSECbis makes no similar statement about a
> > circular name space.
>
> not only that, the circularity is only by mention, not in fact.  it does
> not say that putting your own owner name in as the target name works;
> rather, that the zone name (or apex, or @ in my example) is special cased.

-records draft:

4.1.1  The Next Domain Name Field

   The Next Domain Name field contains the owner name of the next
   authoritative owner name in the canonical ordering of the zone; see
*  Section 6.1 for an explanation of canonical ordering.  The value of
*  the Next Domain Name field in the last NSEC record in the zone is the
*  name of the zone apex (the owner name of the zone's SOA RR).

The circularity is by fact, and @ NSEC @ is by implication:

If the last NSEC record is the only (i.e. also the first, or APEX) NSEC,
it has its owner name in the Next Domain Name field.

Roy