Subject: Re: relevent?

From: Mark Andrews <[email-masked]>
Date: Sat, 22 May 2004 09:11:31 +1000

> [email-masked] writes:
> 
> >> No, I believe sufficient information is present.  To verify that any
> >> wildcard RR doesn't cover the queried name, you compute a few SHA-1
> >> hashes on the only possible wildcard owner names that can be relevant,
> >
> > 	thats a bit presumptious, don't you think?  how can you 
> > 	possibly determine relevant, possible owner names?
> 
> I may have misunderstood something.  Here is how I perceive things.
> 
> Consider any query for a non-existing name a.b.c.d.e.f.com in the zone
> f.com.  To prove that a.b.c.d.e.f.com doesn't exist, the server has to
> return records proving that the following names do not exist:
> 
> a.b.c.d.e.f.com
> *.b.c.d.e.f.com
> *.c.d.e.f.com
> *.d.e.f.com
> *.e.f.com
> *.f.com
> 
> This is the same for NXT, NSEC and presumably all alternatives as
> well.

	You obviously don't understand the "closest encloser"
	restrictions.  ONLY ONE AND EXACTLY ONE of those wildcards
	is relevent.

	You need to know what names exist to determine which wildcard
	to use.  NSEC provides this information in the owner and next
	names (yes both of these are required not just the next name).

	For NO/NSEC2 the information required to determine this has
	to be explicitly provided.

	The actual set of proofs reqired are

		!f.com + !*.com 
	or
		!e.f.com + !*.f.com + %f.com
	or
		!d.e.f.com + !*.e.f.com + %e.f.com
	or
		!c.d.e.f.com + !*.d.e.f.com + %d.e.f.com
	or
		!b.c.d.e.f.com + !*.c.d.e.f.com + %c.d.e.f.com
	or
		!a.b.c.d.e.f.com + !*.b.c.d.e.f.com + %b.c.d.e.f.com

	! == not exist
	% == exist

	I don't believe NO had this as general DNSSEC did not have this
	specified at the time.
	
	Mark
 
> With NXT/NSEC, the verifier can read the "next owner name" field of
> the RRs, and make sure all above names are included in the range of
> some of the returned RRs.
> 
> Since alternative solution doesn't have a "next owner name" field,
> this technique doesn't work.  But the above set of possibly relevant
> owner names is always a small number, so the verifier can compute the
> hash of each of the above strings and verify that all are included in
> the range of all NO RRs returned.
> 
> The only difference in processing is that during each wildcard
> iteration, you compare the hash of the name instead of the name, with
> what is stored in the returned RRs.
> 
> The second complication due to wildcard names is that when the
> response exists and is a wildcard name, you must also prove that no
> more specific owner name exists.  The logic is a bit different, but I
> believe there is no problem implementing it with hashed names.
> 
> Were you thinking of some other problem?  Or is my reasoning flawed?
> 
> Regards,
> Simon
> 
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>