Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-11 Errors in Canonical Form Type Code List

From: Matthijs Mekking <[email-masked]>
Date: Mon, 29 Mar 2010 12:08:15 +0200

George Barwood wrote:
> http://tools.ietf.org/html/draft-ietf-dnsext-dnssec-bis-updates-11#section-5.1
> 
> states
> 
> "When canonicalizing DNS names, DNS names in the RDATA section of NSEC
>    and RRSIG resource records are not downcased."
> 
> citing RFC 3755.
> 
> I have some comments:
> 
> (1) RRSIG records do not need or have a canonical form, since they are not themselves ever signed.
> So the RRSIG reference makes no sense ( unless I'm missing something ).

But they should still be consistent with RFC3597.

> (2) RFC 4034 obsoletes RFC3755, so the citation seems odd. I prefer what RFC 4034 says,
> and don't think it this is an error, rather an improvement.

Again, the text is inconsistent with RFC3597.

> (3) In view of the possibility of interoperability problems, I suggest that signers
> should downcase DNS names in the RDATA section of NSEC and NSEC3 records
> in the signed output. That ensures that signatures will verify regardless of whether a
> resolver has implemented RFC 4034 or RFC 3755.

And again...

The downcasing in the RDATA of NSEC records is ensured by sorting the
zone in canonical order, in prior of creating NSEC records.

Best regards,

Matthijs Mekking
NLnet Labs

> Since the DNS names in NSEC3 RDATA are generated by the signer, this is the obvious choice in any case,
> and almost certainly what current implementations do. The examples in RFC 5155 all show lower-case names, but
> there doesn't seem to be any definitive statement that rules out upper case names. A statement to that effect might be useful.
> 
> George