Subject: closest provable encloser vs closest encloser

From: Mark Andrews <[email-masked]>
Date: Tue, 22 Aug 2006 14:10:49 +1000

Can anyone demonstrate a case were the closest provable encloser
	is not the closest encloser?

	Mark

-- 
ISC Training!  October 16-20, 2006, in the San Francisco Bay Area,
covering topics from DNS to DHCP.  Email [email-masked].
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE:	+61 2 9871 4742		         INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Wouter Wijngaards <[email-masked]>
Date: Tue, 22 Aug 2006 09:16:57 +0200

> 	is not the closest encloser?
I'll give my understanding, if I'm wrong I need to adjust my code :-)

You have an opt-out NSEC3 zone, with x.example.com uncovered by the
NSEC3 chain. x.example.com is a delegation that is opt-out. For a
question for a.x.example.com, example.com is the closest provable
encloser (it has NSEC3), x.example.com is the closest encloser, but
cannot be proven to exist since it is covered by an opt-out nsec3. This
is shown in example B.3 in nsec3-06 draft.

This can be multiple labels deep - have z.y.x.example.com opt-out
delegation, with example.com as closest provable encloser.

Hope this helps,
   Wouter

---

From: Mark Andrews <[email-masked]>
Date: Tue, 22 Aug 2006 17:30:12 +1000

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Mark Andrews wrote:

	I was thinking from the validators point of view.  Once
	I rethought from the authserver's point of view I realised
	it was a stupid question.

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.5 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
> 
> iD8DBQFE6q9pkDLqNwOhpPgRAnE4AJ9vGBgB8NTkFcmeiHoj9pStTHeXJACffuBb
> Rzs0n9oOE4gdebqZzYalQiw=
> =bd7r
> -----END PGP SIGNATURE-----
> 
> --

---

From: Edward Lewis <[email-masked]>
Date: Tue, 22 Aug 2006 09:07:55 -0400

>>  > 	is not the closest encloser?
...
>	it was a stupid question.

Do you mean - "is there ever going to be a valid situation in which
a name exists in a zone between the closest provable encloser and
the query name?"

The answer to that is yes, using the same example Wouter cited.  I.e.,
even though example.com is the closest provable encloser, it is not the
closest (provable|unprovable) encloser.  And why a.x.example.com is not
matched by *.example.com.  (Thus the wildcard/opt-in conundrum.)

Maybe I am misunderstanding the question.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Soccer/Futbol. IPv6.  Both have lots of 1's and 0's and have a hard time
catching on in North America.