Subject: Re: DNSSECbis-records-05 compression issue

From: Paul Vixie <[email-masked]>
Date: Tue, 04 Nov 2003 00:35:23 +0000

> > I propose that the text in above sections be changed to say:
> > Domain name compression on MUST NOT be performed[RFC3597].
> > 
> > The reason to make this explicit is it will allow more rapid detection
> > of compression attempts, than if recipients silently decompress.

and i agree, for that reason.

> <hat=just-another-bozo-on-this-bus>
> 
> I happen to believe that applying the Robustness Principle is correct
> here.  YMMV.
> 
> </hat>

i think silent failure-to-fail is a bad idea, and that the robustness
principal is in need of an update in at least that regard.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Wed, 05 Nov 2003 01:35:19 +0000

> > arguably not.  these should be removed during the process of
> > reading/loading/ importing the zone, and so the signer should never
> > see them, nor should axfr be able to transfer them, or query be able
> > to return them.
> 
> But if for some reason a zone signer were somehow to see such
> duplicates, said zone signer should generate signatures based on the
> RRset with the duplicates removed.  Right?

ideally not.  a zone signer should signal an error and give up under
those conditions.  silently ignoring bad data is not always a favour,
especially where security, and zone identity, are concerned.

---

From: Paul Vixie <[email-masked]>
Date: Wed, 05 Nov 2003 19:11:01 +0000

> I think Matt's pegged it.  Format 1 is clever but more complicated
> than the problem at hand seems to merit.  My preference would be
> either format 0 or David's trivial optimization on format 0.

i very nearly agree, but if so then the draft needs an explaination
of the fact that no secured name can have more than 32000 type codes
in use.