Subject: Re: Just send UTF-8 with nameprep (was: RE: [idn] Reality Check)

From: Dan Oscarsson <[email-masked]>
Date: Tue, 24 Jul 2001 08:57:47 +0200 (MEST)

Paul Hoffman wrote:

>
>Dan, it is not clear from the udns-02 document that the protocol 
>requires nameprep on the name server for every query. This is a 
>fairly important design choice of UDNS that should probably be 
>highlighted in the document. As you have seen, some people who 
>thought they were supporting udns-02 don't think this is such a great 
>idea, and it is quite controversial for name servers that run high 
>volumes of queries (like tens of thousands a second).

It would be interesting if somebody have some real data to show
if it really is that CPU heavy.
In UDNS all character data is required to be normalised.
Because of this a lot of the form insensitive matching that nameprep
represents can be done "on the fly" just like the case insensitive
matching of ASCII that is done today.

If we want to compare what things are expensive (take a lot of CPU
or memory) we should try to get data on several things. For example:
- UTF-8 (UCS) to/from ACE
- normalisation of a text (Unicode from C or KC)
- full nameprep (with both normalisation and form folding)
- just form folding
- optimised name matching where the input strings are normalised
  strings and the form insensitive matching according to nameprep
  is done in most efficient manner.

I am sure there are more things that we need data to decide how
things best should be done.

    Dan

---

From: Patrik Fältström <[email-masked]>
Date: Tue, 24 Jul 2001 10:54:36 +0200

> if it really is that CPU heavy.

We have problems today with DNS as it is without DNSSEC, A6, DNAME, etc etc
and as I said before, I really want changes to the way DNS works today to
be handled in the DNSOP and DNSEXT wg's and not this.

Regarding only doing nameprep in the authoritative servers, that is
definitly not enough. That means that you might get a query after owner A,
which nameprepped is B, and because of this, one send a query for owner A,
but get B as a response.

I really want DNS servers to reject those kind of responses (where the
owner in the response doesn't match the owner in the query), and I hope
they do check this today, or we would have cache poisoning all over the
place.

I.e. doing nameprep only in authoritative servers is firstly a security
issue and secondly a performance issue.

But, most importantly, I don't find this group being the one which can even
think about DNS complexity.

  paf

---

From: Bob Halley <[email-masked]>
Date: 24 Jul 2001 14:30:32 -0700

> which nameprepped is B, and because of this, one send a query for owner A,

This is a good point!

> owner in the response doesn't match the owner in the query),

BIND 4, 8, and 9 will reject such responses, both in "named" and in
libresolv.

/Bob