Re: [Ext] [Technical Errata Reported] RFC5155 (4993)

Roy Arends <[email protected]> Tue, 18 Apr 2017 18:45:01 +0000
Newsgroups gmane.ietf.dnsext
Message-ID <[email protected]>
The erratum is incorrect.

The hash value for ns1.example is explicitly used as an owner name for a regular record (2t7b4g4vsa5smi47k61mv5bv1a22bojr.example A 192.0.2.127) to show that a potential collision between the owner names and the hashed space has no impact.

Roy


> Forwarded message:
> 
>> From: RFC Errata System <[email protected]>
>> To: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
>> Cc: [email protected], [email protected]
>> Subject: [dnsext] [Technical Errata Reported] RFC5155 (4993)
>> Date: Thu, 13 Apr 2017 09:12:07 -0700 (PDT)
>> 
>> The following errata report has been submitted for RFC5155,
>> "DNS Security (DNSSEC) Hashed Authenticated Denial of Existence".
>> 
>> --------------------------------------
>> You may review the report below and at:
>> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rfc-2Deditor.org_errata-5Fsearch.php-3Frfc-3D5155-26eid-3D4993&d=DwIBAg&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=6rdmyw1VGzYGRLDSg4Nv6YlsOHnMB5FIzSs7DYirTNA&m=gWuOL6YbGLIJ7P7JlR4-OcptwWJsKAI9HfdjdCPIkbQ&s=ZvqiH08zLZs-opG3e6PfrhQu01cR5ADlM68SWCPfyFE&e= 
>> --------------------------------------
>> Type: Technical
>> Reported by: Dick Franks <[email protected]>
>> 
>> Section: Appendix A
>> 
>> Original Text
>> -------------
>>  ; H(example)       = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
>>  ; H(a.example)     = 35mthgpgcu1qg68fab165klnsnk3dpvl
>>  ; H(ai.example)    = gjeqe526plbf1g8mklp59enfd789njgi
>>  ; H(ns1.example)   = 2t7b4g4vsa5smi47k61mv5bv1a22bojr
>>  ; H(ns2.example)   = q04jkcevqvmu85r014c7dkba38o0ji5r
>>  ; H(w.example)     = k8udemvp1j2f7eg6jebps17vp3n8i58h
>>  ; H(*.w.example)   = r53bq7cc2uvmubfu5ocmm6pers9tk9en
>>  ; H(x.w.example)   = b4um86eghhds6nea196smvmlo4ors995
>>  ; H(y.w.example)   = ji6neoaepv8b5o6k4ev33abha8ht9fgc
>>  ; H(x.y.w.example) = 2vptu5timamqttgl4luu9kg21e0aor3s
>>  ; H(xx.example)    = t644ebqk9bibcna874givr6joj62mlhv
>> - ; H(2t7b4g4vsa5smi47k61mv5bv1a22bojr.example)
>> - ;                  = kohar7mbb8dc2ce8a9qvl8hon4k53uhi
>>  example. 3600  IN SOA  ns1.example. bugs.x.w.example. 1 3600 300 (
>>                         3600000 3600 )
>>                 NS      ns1.example.
>>                 NS      ns2.example.
>>                 MX      1 xx.example.
>>                 DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU (
>>                         sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h
>>                         TY4hHn9npWFRw5BYubE= )
>>                 DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ (
>>                         j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9
>>                         AbsUdblMFin8CVF3n4s= )
>>                 NSEC3PARAM 1 0 12 aabbccdd:1
>>  0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd (
>>                         2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS
>>                         SOA NSEC3PARAM RRSIG )
>> ! 2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. A 192.0.2.127
>> !                NSEC3   1 1 12 aabbccdd (
>>                         2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG )
>>  2vptu5timamqttgl4luu9kg21e0aor3s.example. NSEC3 1 1 12 aabbccdd (
>>                         35mthgpgcu1qg68fab165klnsnk3dpvl MX RRSIG )
>>  35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd (
>>                         b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
>>  a.example.     NS      ns1.a.example.
>>                 NS      ns2.a.example.
>>                 DS      58470 5 1 (
>>                         3079F1593EBAD6DC121E202A8B766A6A4837206C )
>>  ns1.a.example. A       192.0.2.5
>>  ns2.a.example. A       192.0.2.6
>>  ai.example.    A       192.0.2.9
>>                 HINFO   "KLH-10" "ITS"
>>                 AAAA    2001:db8:0:0:0:0:f00:baa9
>>  b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd (
>>                         gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
>>  c.example.     NS      ns1.c.example.
>>                 NS      ns2.c.example.
>>  ns1.c.example. A       192.0.2.7
>>  ns2.c.example. A       192.0.2.8
>>  gjeqe526plbf1g8mklp59enfd789njgi.example. NSEC3 1 1 12 aabbccdd (
>>                         ji6neoaepv8b5o6k4ev33abha8ht9fgc HINFO A AAAA
>>                         RRSIG )
>>  ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd (
>>                         k8udemvp1j2f7eg6jebps17vp3n8i58h )
>>  k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd (
>> !                        kohar7mbb8dc2ce8a9qvl8hon4k53uhi )
>> ! kohar7mbb8dc2ce8a9qvl8hon4k53uhi.example. NSEC3 1 1 12 aabbccdd (
>> !                        q04jkcevqvmu85r014c7dkba38o0ji5r A RRSIG )
>>  ns1.example.   A       192.0.2.1
>>  ns2.example.   A       192.0.2.2
>>  q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd (
>>                         r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
>>  r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd (
>>                         t644ebqk9bibcna874givr6joj62mlhv MX RRSIG )
>>  t644ebqk9bibcna874givr6joj62mlhv.example. NSEC3 1 1 12 aabbccdd (
>>                         0p9mhaveqvm6t7vbl5lop2u3t2rp3tom HINFO A AAAA
>>                         RRSIG )
>>  *.w.example.   MX      1 ai.example.
>>  x.w.example.   MX      1 xx.example.
>>  x.y.w.example. MX      1 xx.example.
>>  xx.example.    A       192.0.2.10
>>                 HINFO   "KLH-10" "TOPS-20"
>>                 AAAA    2001:db8:0:0:0:0:f00:baaa
>> 
>> Corrected Text
>> --------------
>>  ; H(example)       = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
>>  ; H(a.example)     = 35mthgpgcu1qg68fab165klnsnk3dpvl
>>  ; H(ai.example)    = gjeqe526plbf1g8mklp59enfd789njgi
>>  ; H(ns1.example)   = 2t7b4g4vsa5smi47k61mv5bv1a22bojr
>>  ; H(ns2.example)   = q04jkcevqvmu85r014c7dkba38o0ji5r
>>  ; H(w.example)     = k8udemvp1j2f7eg6jebps17vp3n8i58h
>>  ; H(*.w.example)   = r53bq7cc2uvmubfu5ocmm6pers9tk9en
>>  ; H(x.w.example)   = b4um86eghhds6nea196smvmlo4ors995
>>  ; H(y.w.example)   = ji6neoaepv8b5o6k4ev33abha8ht9fgc
>>  ; H(x.y.w.example) = 2vptu5timamqttgl4luu9kg21e0aor3s
>>  ; H(xx.example)    = t644ebqk9bibcna874givr6joj62mlhv
>>  example. 3600  IN SOA  ns1.example. bugs.x.w.example. 1 3600 300 (
>>                         3600000 3600 )
>>                 NS      ns1.example.
>>                 NS      ns2.example.
>>                 MX      1 xx.example.
>>                 DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU (
>>                         sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h
>>                         TY4hHn9npWFRw5BYubE= )
>>                 DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ (
>>                         j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9
>>                         AbsUdblMFin8CVF3n4s= )
>>                 NSEC3PARAM 1 0 12 aabbccdd:1
>>  0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd (
>>                         2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS
>>                         SOA NSEC3PARAM RRSIG )
>> ! 2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. NSEC3   1 1 12 aabbccdd (
>>                         2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG )
>>  2vptu5timamqttgl4luu9kg21e0aor3s.example. NSEC3 1 1 12 aabbccdd (
>>                         35mthgpgcu1qg68fab165klnsnk3dpvl MX RRSIG )
>>  35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd (
>>                         b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
>>  a.example.     NS      ns1.a.example.
>>                 NS      ns2.a.example.
>>                 DS      58470 5 1 (
>>                         3079F1593EBAD6DC121E202A8B766A6A4837206C )
>>  ns1.a.example. A       192.0.2.5
>>  ns2.a.example. A       192.0.2.6
>>  ai.example.    A       192.0.2.9
>>                 HINFO   "KLH-10" "ITS"
>>                 AAAA    2001:db8:0:0:0:0:f00:baa9
>>  b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd (
>>                         gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
>>  c.example.     NS      ns1.c.example.
>>                 NS      ns2.c.example.
>>  ns1.c.example. A       192.0.2.7
>>  ns2.c.example. A       192.0.2.8
>>  gjeqe526plbf1g8mklp59enfd789njgi.example. NSEC3 1 1 12 aabbccdd (
>>                         ji6neoaepv8b5o6k4ev33abha8ht9fgc HINFO A AAAA
>>                         RRSIG )
>>  ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd (
>>                         k8udemvp1j2f7eg6jebps17vp3n8i58h )
>>  k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd (
>> !                        q04jkcevqvmu85r014c7dkba38o0ji5r )
>>  ns1.example.   A       192.0.2.1
>>  ns2.example.   A       192.0.2.2
>>  q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd (
>>                         r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
>>  r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd (
>>                         t644ebqk9bibcna874givr6joj62mlhv MX RRSIG )
>>  t644ebqk9bibcna874givr6joj62mlhv.example. NSEC3 1 1 12 aabbccdd (
>>                         0p9mhaveqvm6t7vbl5lop2u3t2rp3tom HINFO A AAAA
>>                         RRSIG )
>>  *.w.example.   MX      1 ai.example.
>>  x.w.example.   MX      1 xx.example.
>>  x.y.w.example. MX      1 xx.example.
>>  xx.example.    A       192.0.2.10
>>                 HINFO   "KLH-10" "TOPS-20"
>>                 AAAA    2001:db8:0:0:0:0:f00:baaa
>> 
>> Notes
>> -----
>> The obligatory RRSIG records have been omitted for clarity.
>> 
>> The zone prior to NSEC3 signing seems to have contained an unexpected
>>    2t7b4g4vsa5smi47k61mv5bv1a22bojr.example.	A	192.0.2.127
>> which was then lovingly included in the NSEC3 chain.
>> 
>> The error is readily detectable from the list of hashes of the original owner names. The source zone prior to signing can never contain a hashed name.
>> 
>> For completeness, B5 also needs a corresponding amendment, although this does not invalidate the proof presented therein.
>> 
>> Instructions:
>> -------------
>> This erratum is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party
>> can log in to change the status and edit the report, if necessary.
>> 
>> --------------------------------------
>> RFC5155 (draft-ietf-dnsext-nsec3-13)
>> --------------------------------------
>> Title               : DNS Security (DNSSEC) Hashed Authenticated Denial of Existence
>> Publication Date    : March 2008
>> Author(s)           : B. Laurie, G. Sisson, R. Arends, D. Blacka
>> Category            : PROPOSED STANDARD
>> Source              : DNS Extensions
>> Area                : Internet
>> Stream              : IETF
>> Verifying Party     : IESG
>> 
>> _______________________________________________
>> dnsext mailing list
>> [email protected]
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_dnsext&d=DwIBAg&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=6rdmyw1VGzYGRLDSg4Nv6YlsOHnMB5FIzSs7DYirTNA&m=gWuOL6YbGLIJ7P7JlR4-OcptwWJsKAI9HfdjdCPIkbQ&s=gCe8H3gysKA1qcju4jrBo1FTz1g8Plas_y3oeIF3cKE&e= 

_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext