Re: [Technical Errata Reported] RFC4592 (5119)

This errata report is based on a misunderstanding and should be rejected 
There is no harm in synthesizing NSEC records as long as the owner name of the NSEC record sorts before the target name. 

Olafur

> On Sep 21, 2017, at 6:54 AM, RFC Errata System <[email protected]> wrote:
> 
> The following errata report has been submitted for RFC4592,
> "The Role of Wildcards in the Domain Name System".
> 
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata/eid5119
> 
> --------------------------------------
> Type: Technical
> Reported by: Karst Koymans <[email protected]>
> 
> Section: 4.7
> 
> Original Text
> -------------
> 4.7.  NSEC RRSet at a Wildcard Domain Name
> 
>   Wildcard domain names in DNSSEC signed zones will have an NSEC RRSet.
>   Synthesis of these records will only occur when the query exactly
>   matches the record.  Synthesized NSEC RRs will not be harmful as they
>   will never be used in negative caching or to generate a negative
>   response [RFC2308].
> 
> 
> Corrected Text
> --------------
> 4.7.  NSEC RRSet at a Wildcard Domain Name
> 
>   Wildcard domain names in DNSSEC signed zones will have an NSEC RRSet.
>   NSEC RRSets must not be synthesized from this wildcard NSEC.
> 
> Notes
> -----
> Synthesizing these records would destroy the semantics of the NSEC chain and could be very harmful if implementations would cache them and use them for "Aggressive Use of DNSSEC-Validated Cache" (RFC 8198).
> 
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party  
> can log in to change the status and edit the report, if necessary. 
> 
> --------------------------------------
> RFC4592 (draft-ietf-dnsext-wcard-clarify-11)
> --------------------------------------
> Title               : The Role of Wildcards in the Domain Name System
> Publication Date    : July 2006
> Author(s)           : E. Lewis
> Category            : PROPOSED STANDARD
> Source              : DNS Extensions
> Area                : Internet
> Stream              : IETF
> Verifying Party     : IESG

_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext