Subject: comments on draft-arends-dnsnr-00

From: "Loomis, Rip" <[email-masked]>
Date: Mon, 12 Jul 2004 22:41:06 -0400

Hello Roy--
In section 2.1.3, there is a sentence that says, "The Salt field
value must be the same for every DNSNR generated in the zone."
That may be a reasonable requirement, but off the top of my head
I think I can come up with some good reasons not to make that a
requirement--could you please elaborate (on list or in a revised
draft) as to why that's a "must"?

I also have some very very minor typos which I'll send to you
off-list.

  --Rip

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Tue, 13 Jul 2004 09:10:55 +0200 (CEST)

On Mon, 12 Jul 2004, Scott Rose wrote:

> Just went over the DNSNR draft quickly.  Some comments -
>
> 1.  The acronym MNR and NMR are used, but I don't see them defined anywhere.
> It isn't the authoritative only bit, is it?

Yes it is. MNR must be 'Authoritative Only Field'.

> Because the ascii
> representation says it can have the value of '3'.

Yes. That must be either a value of '0' or '1'.

This is due to a previous version where you could extend the use by having
more granualarity. I decided to drop that in favour of less complexity.

> 2.  The next owner name is represented as a domain name - what if it's a
> hash value?

I will add an example to the draft. A Domain name is never presented as a
hash. Labels are. The label is then represented as a base32 encoded output
of the hash function. In case of SHA-1, the label would be 32 characters
long if no truncation is used.

> 3.  TTL recommendations - Section 2 says there are none, but DNSSECbis has
> the NSEC RR's TTL value be the SOA min.  Is there a good reason not to have
> it be that value?

There is no good reason :-). I will add TTL recommendations to the draft.

> I would like to see this become a WG document as a possible replacement for
> NSEC.  If it can address zone owners' concerns with zone enumeration.

Roy

---

From: Roy Arends <[email-masked]>
Date: Tue, 13 Jul 2004 09:33:28 +0200 (CEST)

> draft) as to why that's a "must"?

I will add text to the draft on why that MUST be for every NSEC for the
same version.

In short, when a nameserver on reception of a query for a non-existent
name must add the proper DNSNR to the response (to repudiate existence),
it needs a salt (x) to augment QNAME, it will hash the result and find the
appropriate DNSNR to proof the hash(salt+qname) does not exist.

If (x) is different for every DNSNR, you might end up with proof claiming
example.com + salt=4 does not exist, and example.com + salt=7 does exist.

> I also have some very very minor typos which I'll send to you

Thanks !

Roy