Subject: Re: base32 alphabet rant - rhaaaaa rfc3548

From: David Blacka <[email-masked]>
Date: Wed, 26 Oct 2005 11:25:51 -0400

On Oct 26, 2005, at 10:41 AM, Peter Koch wrote:

>
>
> Roy Arends wrote:
>
>
>> Is there any specific section in rfc4033/4/5 that restricts using  
>> DNSSEC
>> to prove absence/presence of records with extended label types in its
>> ownername ?
>>
>
> No, the DNSSEC-bis set of document simply doesn't cover non- 
> standard labels.
> This makes them "unsortable" and thus they are not covered by NSEC  
> RRs.
> Presence of RRSets with such labels is no problem at all.

Um, just because RFCs 4033-4035 don't cover non-standard labels  
doesn't make them problem-free wrt DNSSEC.

>
>> Your point was:
>>
>> ''this could also elegantly solve the "paradox problem", where the  
>> NSEC3
>> chain denies its owners' existance.''
>>
>> Where ''this'' refered to using an extended label type for 8 bit  
>> labels.
>>
>
> Exactly. There were two previous approaches to this anomaly:
>
> 1) Declare the owners of NSEC to be outside the namespace - by  
> definition.
>    This is straightforward, but has the drawback that the property  
> of the
>    name is determined by its ownership of a special RR type.
>
> 2) IIRC marka once suggested to use the hash only as an ownername  
> (without
>    appending $ORIGIN). Solves the length issue, uses a different  
> namespace
>    but more or less changes the paradigm from data based to  
> transaction based.
>
> A new label type makes the owner of an NSEC3 RR be outside the classic
> namespace while still being adata based approach.

IF this paradox problem is in fact a problem, there is an easier  
solution than #2.

>
>> Indeed. One would need to define sort-order for 8 bit labels for the
>> purpose of dnssec.
>>
>
> No, why?

So that any other RR type using the extended label would be coverable  
by DNSSEC.  Or are you suggesting that an extended label type be  
dedicated to NSEC3?

>
>> I don't think the 'paradox problem' is a real issue.
>>
>
> It is an anomaly. I do not know whether it will turn out to be an  
> issue.

Me neither.

--
David Blacka    <[email-masked]>
Sr. Engineer    VeriSign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Peter Koch <[email-masked]>
Date: Wed, 26 Oct 2005 21:29:35 +0200

> by DNSSEC.  Or are you suggesting that an extended label type be  

"dedicated" in the sense that this label type would primarily satisfy the
needs of NSEC3 -- yes.
"dedicated" in the sense that other RR type MUST NOT be owned by an owner
with such label -- no. Anyone brave enough to do so would have to know
and accept that in this part of the name space there is no authenticated
denial.

-Peter