Re: [Technical Errata Reported] RFC5155 (4622)

--===============5700879924847213415==
Content-Language: en-US
Content-Type: multipart/signed;
 boundary="Apple-Mail=_7EB03420-E23C-47E9-B733-014C235EF8BA";
 protocol="application/pkcs7-signature"; micalg=sha1

--Apple-Mail=_7EB03420-E23C-47E9-B733-014C235EF8BA
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=windows-1252


> On Feb 19, 2016, at 10:11 AM, Brian Haberman =
<[email protected]> wrote:
>=20
> Does anyone have an opinion on the validity of this erratum? It seems
> like a reasonable clarification in my reading.

The clarification looks correct and reasonable to me.

>=20
> Brian
>=20
> On 2/17/16 8:36 PM, RFC Errata System wrote:
>> The following errata report has been submitted for RFC5155,
>> "DNS Security (DNSSEC) Hashed Authenticated Denial of Existence".
>>=20
>> --------------------------------------
>> You may review the report below and at:
>> http://www.rfc-editor.org/errata_search.php?rfc=3D5155&eid=3D4622
>>=20
>> --------------------------------------
>> Type: Technical
>> Reported by: Robert Edmonds <[email protected]>
>>=20
>> Section: 7.2.8
>>=20
>> Original Text
>> -------------
>> 7.2.8.  Responding to Queries for NSEC3 Owner Names
>>=20
>>   The owner names of NSEC3 RRs are not represented in the NSEC3 RR
>>   chain like other owner names.  As a result, each NSEC3 owner name =
is
>>   covered by another NSEC3 RR, effectively negating the existence of
>>   the NSEC3 RR.  This is a paradox, since the existence of an NSEC3 =
RR
>>   can be proven by its RRSIG RRSet.
>>=20
>>   If the following conditions are all true:
>>=20
>>   o  the QNAME equals the owner name of an existing NSEC3 RR, and
>>=20
>>   o  no RR types exist at the QNAME, nor at any descendant of QNAME,
>>=20
>>   then the response MUST be constructed as a Name Error response
>>   (Section 7.2.2).  Or, in other words, the authoritative name server
>>   will act as if the owner name of the NSEC3 RR did not exist.
>>=20
>>=20
>> Corrected Text
>> --------------
>> 7.2.8.  Responding to Queries for NSEC3 Owner Names
>>=20
>>   The owner names of NSEC3 RRs are not represented in the NSEC3 RR
>>   chain like other owner names.  As a result, each NSEC3 owner name =
is
>>   covered by another NSEC3 RR, effectively negating the existence of
>>   the NSEC3 RR.  This is a paradox, since the existence of an NSEC3 =
RR
>>   can be proven by its RRSIG RRSet.
>>=20
>>   If the following conditions are all true:
>>=20
>>   o  the QNAME equals the owner name of an existing NSEC3 RR, and
>>=20
>>   o  no RR types exist at the QNAME besides NSEC3, nor at any
>>      descendant of QNAME,
>>=20
>>   then the response MUST be constructed as a Name Error response
>>   (Section 7.2.2).  Or, in other words, the authoritative name server
>>   will act as if the owner name of the NSEC3 RR did not exist.
>>=20
>>=20
>> Notes
>> -----
>> If the QNAME is equal to the owner name of an existing NSEC3 RR, then =
the NSEC3 RR type itself will exist at the QNAME, and the second =
condition will always be false.
>>=20
>> Instructions:
>> -------------
>> This erratum is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party (IESG)
>> can log in to change the status and edit the report, if necessary.=20
>>=20
>> --------------------------------------
>> RFC5155 (draft-ietf-dnsext-nsec3-13)
>> --------------------------------------
>> Title               : DNS Security (DNSSEC) Hashed Authenticated =
Denial of Existence
>> Publication Date    : March 2008
>> Author(s)           : B. Laurie, G. Sisson, R. Arends, D. Blacka
>> Category            : PROPOSED STANDARD
>> Source              : DNS Extensions
>> Area                : Internet
>> Stream              : IETF
>> Verifying Party     : IESG
>>=20
>=20

--
David Blacka                          <[email protected]>=20
Distinguished Engineer                Verisign Product Engineering






--Apple-Mail=_7EB03420-E23C-47E9-B733-014C235EF8BA
Content-Disposition: attachment; filename="smime.p7s"
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINtDCCBmAw
ggVIoAMCAQICEHaFyweo4MwP0sVNjzk1sxIwDQYJKoZIhvcNAQEFBQAwgcoxCzAJBgNVBAYTAlVT
MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29y
azE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ug
b25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0
aW9uIEF1dGhvcml0eSAtIEczMB4XDTExMDYwNzAwMDAwMFoXDTIxMDYwNjIzNTk1OVowgckxCzAJ
BgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50
ZWMgVHJ1c3QgTmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFs
IFN1YnNjcmliZXIgQ0ExQzBBBgNVBAMTOlN5bWFudGVjIENsYXNzIDIgU2hhcmVkIEludGVybWVk
aWF0ZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQC3+D8MK4MjIIWmTUkBUTra3VAzvuMEpDo+o2FmTDTC6HRwdUmlt0ns3bOSnN15DeK5+rg5PL6F
44zvbXmjprcIv5xMvj6YjqzbfJor7AUoMF8pGzNNRNVw6FYimaY+nUJb6yOnY50tLLAuPxjzKc0a
NomEksdXcFtwheY4oXxQ4zc4iGVba8s5KgSxgqoZBP+gfz+j25FFdmaja/OFI15O2YVddaegFffB
AHTg5cqUQmWawjd6i6hQrL+XdGd30TKnr43Lk6klQrQwGnQK4iUQEMt0Z1UPyxT8QVAKpHxNCwv5
Bak1+UWnMfGAu6LJPs52OeEq/3ZQ5+hRIt8tz7gzAgMBAAGjggI/MIICOzASBgNVHRMBAf8ECDAG
AQH/AgEAMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTItZzMu
Y3JsMA4GA1UdDwEB/wQEAwIBBjApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRVmVyaVNpZ25NUEtJ
LTItNTYwHQYDVR0OBBYEFNhIKahfKheS4vqee+9vYIP4uLjcMIHwBgNVHSMEgegwgeWhgdCkgc0w
gcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNp
Z24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIEluYy4gLSBGb3Ig
YXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMiBQdWJsaWMgUHJp
bWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczghBhcMtJjF+YRSnnsKbZUFt6MDQGCCsG
AQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AudmVyaXNpZ24uY29tMGwGA1UdIARl
MGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9j
cHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwDQYJKoZIhvcNAQEF
BQADggEBAKYqmwdAyez/s4joRdo00RcPKC23pYVnMc3B5tUphjis4vBZGwzhoUXOJHjvacGwTGGi
SNloT7r+dVQ3ulhp6sF2pTZC6p5meJAg2ZVqJHlUzd5aGoo7rhiVctAl2NJGvjQwp4Ce8VbOIB5s
Z8lNT3mHieIugNae7SZhZaID0MXi8yi5K0lpgmfs1ek0pC7cYiKkhU1I42oClPLN/eRnyEm8qtXH
5zzeh7EQa10HXBnka6D0T5nL3LVbDMwy+WrkdMAqWDd5s/vNwzRv4XbdEAcAY4sHTicXkkebDr7e
DROFEfyiL2V9zDqsHlRrVmfE7qWHIiMXK3BWw/Gud1wnwTkwggdMMIIGNKADAgECAhA5tGWhlt5X
22yZo/aBwRVEMA0GCSqGSIb3DQEBBQUAMIHJMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50
ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsT
LENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBMUMwQQYDVQQDEzpT
eW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRlcm1lZGlhdGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5
MB4XDTE1MDIxOTAwMDAwMFoXDTE2MDMwMjIzNTk1OVowbTEiMCAGCSqGSIb3DQEJARYTZGF2aWRi
QHZlcmlzaWduLmNvbTEWMBQGA1UEAwwNQmxhY2thLCBEYXZpZDEWMBQGA1UECwwNRU5URVJQUklT
RSBJVDEXMBUGA1UECgwOVmVyaVNpZ24sIEluYy4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQCs0UlNOAODGuwcpxB1HyTslCBsgR+KlIEGzyExqWCVdSJ39rW+moTPkY1zE2cVdljs5ssE
EhhF1fzxYkpwYOborg+hI0ssqt9JqtlSbJsqprXXmGpilQ1E1MAl0hOCAhi7htqB/LmPhP5uRPKg
VziUXuzASpqsZsL/o0KM9XwXXioZWB5Z4NUntOGbRY7zr2YOlRJdEcR42vYGpsIlzJACyrJgQri/
bD4otsta0j0csxd1v9oZup6TSi0fsqm53bIgAAbgZ++dd/fEBY423vfG5AJPBdduuDHwjfsiYCAA
LgPJdkhXiwvVdGqG9sp1f/WqSE2GC19D01GmPmjeDBSfAgMBAAGjggOJMIIDhTAMBgNVHRMBAf8E
AjAAMA4GA1UdDwEB/wQEAwIFoDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDBDAdBgNVHQ4EFgQUVoVK
aC1xEPB9EWKq3dWrwskIufkwHgYDVR0RBBcwFYETZGF2aWRiQHZlcmlzaWduLmNvbTAfBgNVHSME
GDAWgBTYSCmoXyoXkuL6nnvvb2CD+Li43DCCAXEGCCsGAQUFBwEBBIIBYzCCAV8wJwYIKwYBBQUH
MAGGG2h0dHA6Ly9wa2ktb2NzcC5zeW1hdXRoLmNvbTCCATIGCCsGAQUFBzAChoIBJGxkYXA6Ly9k
aXJlY3RvcnkudmVyaXNpZ24uY29tL0NOJTIwJTNEJTIwU3ltYW50ZWMlMjBDbGFzcyUyMDIlMjBT
aGFyZWQlMjBJbnRlcm1lZGlhdGUlMjBDZXJ0aWZpY2F0ZSUyMEF1dGhvcml0eSUyQ09VJTIwJTNE
JTIwQ2xhc3MlMjAyJTIwTWFuYWdlZCUyMFBLSSUyMEluZGl2aWR1YWwlMjBTdWJzY3JpYmVyJTIw
Q0ElMkNPVSUyMCUzRCUyMFN5bWFudGVjJTIwVHJ1c3QlMjBOZXR3b3JrJTJDTyUyMCUzRCUyMFN5
bWFudGVjJTIwQ29ycG9yYXRpb24lMkNDJTIwJTNEJTIwVVM/Y0FDZXJ0aWZpY2F0ZTtiaW5hcnkw
XQYDVR0fBFYwVDBSoFCgToZMaHR0cDovL3BraS1jcmwuc3ltYXV0aC5jb20vY2FfMDdiYjdkNjQ3
N2NmNGY2YmU5NmFmMWIzNmNhYmQzMTYvTGF0ZXN0Q1JMLmNybDBsBgNVHSAEZTBjMGEGC2CGSAGG
+EUBBxcCMFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vY3BzMCgGCCsGAQUF
BwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMEIGCSqGSIb3DQEJDwQ1MDMwCgYIKoZI
hvcNAwcwCwYJYIZIAWUDBAECMAsGCWCGSAFlAwQBFjALBglghkgBZQMEASowLAYKYIZIAYb4RQEQ
AwQeMBwGEmCGSAGG+EUBEAECAgEBi/HGCRYGMjQ3NjY0MDkGCmCGSAGG+EUBEAUEKzApAgEAFiRh
SFIwY0hNNkx5OXdhMmt0Y21FdWMzbHRZWFYwYUM1amIyMD0wDQYJKoZIhvcNAQEFBQADggEBALOq
TUGAtFutNz1xdrgU+019PnljzpswtmGD1dK2s4sBq719Alxf8CYULlRgY5qNr4NZVnmYmRSobeKz
OYGTYWm+KJzoTkIz6JfVTFk67KcowOZxWLNiYzVydkACuPDYS8sS7EIDXd+AyJNcvozVn5a91Mf8
gyPgqecm3pD0KDGvVAUxWuC1TSe0NBgRm3gKMrBW3qONpB7y9ilG+anVGK297q5g4QqwukPIIVAd
t/v0BY/QhdQqrqTeKt4W6DT5tiGkAW3V59ztpNCWD1BDIr7h8QAYZowJxIuzrEc9lmBiSlxDGBhc
Bvh3Uq2OfeNQmctYux/N+HvJWGx5MCkTtp8xggRNMIIESQIBATCB3jCByTELMAkGA1UEBhMCVVMx
HTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBO
ZXR3b3JrMTUwMwYDVQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJl
ciBDQTFDMEEGA1UEAxM6U3ltYW50ZWMgQ2xhc3MgMiBTaGFyZWQgSW50ZXJtZWRpYXRlIENlcnRp
ZmljYXRlIEF1dGhvcml0eQIQObRloZbeV9tsmaP2gcEVRDAJBgUrDgMCGgUAoIICQzAYBgkqhkiG
9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjAyMTkxNjM3NTVaMCMGCSqGSIb3
DQEJBDEWBBRT3JQE1B8VCparkVXovChda0rIgTCB7wYJKwYBBAGCNxAEMYHhMIHeMIHJMQswCQYD
VQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVj
IFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBT
dWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRlcm1lZGlh
dGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5AhA5tGWhlt5X22yZo/aBwRVEMIHxBgsqhkiG9w0BCRAC
CzGB4aCB3jCByTELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8w
HQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUwMwYDVQQLEyxDbGFzcyAyIE1hbmFnZWQg
UEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTFDMEEGA1UEAxM6U3ltYW50ZWMgQ2xhc3MgMiBT
aGFyZWQgSW50ZXJtZWRpYXRlIENlcnRpZmljYXRlIEF1dGhvcml0eQIQObRloZbeV9tsmaP2gcEV
RDANBgkqhkiG9w0BAQEFAASCAQB1xNmKIXuSChTJvqPu+4pMukaFnNp+59JNix+b6Wfj81EjujAj
mb7Q1hadYD5ThbvBYXai3cv/QhTZFX1fsyUKHttC2ZmPsKFSixwbp5t8bc7C5Sr+T8ufm0gVSK1d
BMXumtX6SWCdgBgAvzJTowJiNxrLZq7/U+b8khbUhGaGl7Onuxti6YM6s4UKq+IOxqUh2ubo4ZA5
oRS06CwqKf1ear9eEFrti1mgHmi/3iGmhrYDXa7Wh03mPaPiT791ZixSS/NtDwd2tNhyluaBvsuw
3BNKBoT3zhAHFKfyOyjH8Ebbi5jXKIULjxLhnGnODD4RohrnS8Af2tAgbPkfY2s5AAAAAAAA

--Apple-Mail=_7EB03420-E23C-47E9-B733-014C235EF8BA--


--===============5700879924847213415==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext

--===============5700879924847213415==--