MARC - Revision history

Admin: 21 revisions imported

2022-11-09T14:49:53Z

21 revisions imported

← Older revision	Revision as of 16:49, 9 November 2022
(No difference)

ucis>Barfoo: more specific description of glue format for domain NS records

2014-12-10T17:53:02Z

more specific description of glue format for domain NS records

← Older revision		Revision as of 19:53, 10 December 2014
Line 159:		Line 159:
	*** 'ns': recommended, dictionary listing name servers for the zone		*** 'ns': recommended, dictionary listing name servers for the zone
	**** Key: string, part before the domain name without dot for in-zone nameservers having a glue record or a FQDN with a final dot for out-of-zone nameservers		**** Key: string, part before the domain name without dot for in-zone nameservers having a glue record or a FQDN with a final dot for out-of-zone nameservers
	**** Value: ~~collection~~ containing strings, each item defines a glue IPv4 or IPv6 address in text representation for ~~an in~~-zone nameserver~~; should~~ be ignored for ~~out-~~of~~-zone nameservers~~		**** Value:
			***** for an in-zone nameserver: list containing strings, each item defines a glue IPv4 or IPv6 address in text representation.
			***** for out-of-zone nameserver: NULL. Should be ignored during export of DNS data for tinydns/bind, regardless of type.

	== Anonet importing rules ==		== Anonet importing rules ==

ucis>Barfoo: add clarification what "no data" means in this context

2014-12-10T08:31:25Z

add clarification what "no data" means in this context

← Older revision		Revision as of 10:31, 10 December 2014
Line 57:		Line 57:
	**** Extension data length (2 bytes, 16 bit big-endian integer)		**** Extension data length (2 bytes, 16 bit big-endian integer)
	**** Extension data		**** Extension data
	***** Identifier 1=transfer-to-key: the field contains a 32 byte public key that is allowed to update the resource in addition to the owning key, or no data to allow the resource to be updated by any key.		***** Identifier 1=transfer-to-key: the field contains a 32 byte public key that is allowed to update the resource in addition to the owning key, or no data (Extension data length = 0) to allow the resource to be updated by any key.
	***** Identifier 4=expiration-timestamp: the field contains a 32-bit big-endian integer representing timestamp on which the resource is to be deleted. This value should be ignored if it is higher than Serial+3652460*60 (more than one year in the future).		***** Identifier 4=expiration-timestamp: the field contains a 32-bit big-endian integer representing timestamp on which the resource is to be deleted. This value should be ignored if it is higher than Serial+3652460*60 (more than one year in the future).
	** Encoded value (see [[#Complex structure encoding\|Complex structure encoding]], this block covers the remainder of the update message)		** Encoded value (see [[#Complex structure encoding\|Complex structure encoding]], this block covers the remainder of the update message)

ucis>Barfoo: formatting of long condition

2014-11-16T00:10:46Z

formatting of long condition

← Older revision		Revision as of 02:10, 16 November 2014
Line 31:		Line 31:
	# if a resource with the given label exists:		# if a resource with the given label exists:
	## if the current serial is higher than or equal to the update serial, ignore the update		## if the current serial is higher than or equal to the update serial, ignore the update
	## if the key in the update is different from the current key AND the current serial is not lower than the current unix timestamp - 3652460*60 (1 year) AND (the expiration timestamp is not set OR the expiration timestamp is not lower than the current unix timestamp) AND (the transfer-to-key extension is not set or the transfer-to-key extension value does not match the key in the update)~~, ignore the update~~		## ignore the update if:
			### the key in the update is different from the current key
			### AND the current serial is not lower than the current unix timestamp - 3652460*60 (1 year)
			### AND (the expiration timestamp is not set OR the expiration timestamp is not lower than the current unix timestamp)
			### AND (the transfer-to-key extension is not set or the transfer-to-key extension value does not match the key in the update)
	# optional: if the update is too big (per node configuration), ignore the update		# optional: if the update is too big (per node configuration), ignore the update
	# optional: if the label is not acceptable (e.g. does not represent a valid IP network, AS number or domain name; node specific policy), ignore the update		# optional: if the label is not acceptable (e.g. does not represent a valid IP network, AS number or domain name; node specific policy), ignore the update

Admin: /* Anonet resource encoding */

2013-11-14T23:41:40Z

Anonet resource encoding

← Older revision		Revision as of 01:41, 15 November 2013
Line 115:		Line 115:
	*** 'descr': optional, string, free text, description		*** 'descr': optional, string, free text, description
	*** 'seckey': optional, used to improve deniability by not storing the secret key locally. Contains the first 32 bytes of the secret key in encrypted form.		*** 'seckey': optional, used to improve deniability by not storing the secret key locally. Contains the first 32 bytes of the secret key in encrypted form.
	**** rounds, ~~4 byte~~ big-endian integer, defining the number of rounds to hash. If rounds == 0 the key is not encrypted at all.		**** Number of rounds, 32 bit big-endian integer, defining the number of rounds to hash. If rounds is 0, the key is implicitly not encrypted at all.
	**** key, encrypted secret key as follows: secretkey XOR ~~first 32 bytes of~~ hash_result, where hash_result is initialized as 64*~~\x00~~ and then modified ~~like $~~rounds ~~times~~ sha512(hash_result + utf-8(passphrase) + publickey), passphrase is an UTF-8 string chosen by the user and the public key is the same as used ~~for~~ this record.		**** Encrypted key, first 32 bytes of the encrypted secret key as follows: secretkey XOR hash_result, where hash_result is initialized as 64*0x00 and then modified ''Number of rounds'' as hash_result = sha512(hash_result + utf-8(passphrase) + publickey), where + means concatenation, passphrase is an UTF-8 encoded string chosen by the user and the public key is the same as used to sign this record.
	* IPv4 network		* IPv4 network
	** label (6 bytes):		** label (6 bytes):
Line 126:		Line 126:
	*** 'descr': optional, string, free text, description		*** 'descr': optional, string, free text, description
	*** 'as': optional, numeric string, as number announcing this network		*** 'as': optional, numeric string, as number announcing this network
	*** '~~dns~~': optional, ~~collection~~, see the Domain resource type, defines the reverse DNS zone for the IP network		*** 'ns': optional, dictionary, see the Domain resource type, defines the reverse DNS zone for the IP network
	* IPv6 network		* IPv6 network
	** label (18 bytes):		** label (18 bytes):
Line 136:		Line 136:
	*** 'descr': optional, string, free text, description		*** 'descr': optional, string, free text, description
	*** 'as': optional, numeric string, as number announcing this network		*** 'as': optional, numeric string, as number announcing this network
	*** '~~dns~~': optional, ~~collection~~, see the Domain resource type, defines the reverse DNS zone for the IP network		*** 'ns': optional, dictionary, see the Domain resource type, defines the reverse DNS zone for the IP network
	* AS number		* AS number
	** label (5 bytes):		** label (5 bytes):
Line 153:		Line 153:
	*** 'owner': optional, string, free text, name of owner		*** 'owner': optional, string, free text, name of owner
	*** 'descr': optional, string, free text, description		*** 'descr': optional, string, free text, description
	*** 'ns': recommended, ~~collection containing~~ dictionary ~~items~~		*** 'ns': recommended, dictionary listing name servers for the zone
	**** ~~'ns'~~: string, part before the domain name without dot for in-zone nameservers having a glue record or a FQDN with a final dot for out-of-zone nameservers		**** Key: string, part before the domain name without dot for in-zone nameservers having a glue record or a FQDN with a final dot for out-of-zone nameservers
	**** ~~'glue4'~~: ~~optional~~, ~~string, contains an~~ IPv4 address in text representation ~~to use as a glue record~~ for ~~the nameserver~~		**** Value: collection containing strings, each item defines a glue IPv4 or IPv6 address in text representation for an in-zone nameserver; should be ignored for out-of-zone nameservers
	**** 'glue6': optional, string, contains an ~~IPv6 address~~ in ~~text representation to use as a glue record~~ for ~~the nameserver~~

	== Anonet importing rules ==		== Anonet importing rules ==

ucis>Barfoo at 23:22, 13 November 2013

2013-11-13T23:22:15Z

← Older revision		Revision as of 01:22, 14 November 2013
Line 114:		Line 114:
	*** 'owner': optional, string, free text, name of owner		*** 'owner': optional, string, free text, name of owner
	*** 'descr': optional, string, free text, description		*** 'descr': optional, string, free text, description
	*** 'seckey': optional, ~~contains the first 32 bytes of the secret key of this key pair, use~~ to improve deniability by not storing the key locally; the ~~expanded~~ secret key ~~can be reconstructed by concatenating the public key to this data~~		*** 'seckey': optional, used to improve deniability by not storing the secret key locally. Contains the first 32 bytes of the secret key in encrypted form.
	*** ~~'seckeyenc': optional~~, ~~contains~~ the ~~first 32 bytes~~ of the secret key ~~encrypted~~ as follows: secretkey XOR sha512(publickey ~~+ password~~), ~~where password~~ is an ~~ASCII~~ string chosen by the user and the public key is used ~~as a salt~~		**** rounds, 4 byte big-endian integer, defining the number of rounds to hash. If rounds == 0 the key is not encrypted at all.
			**** key, encrypted secret key as follows: secretkey XOR first 32 bytes of hash_result, where hash_result is initialized as 64*\x00 and then modified like $rounds times sha512(hash_result + utf-8(passphrase) + publickey), passphrase is an UTF-8 string chosen by the user and the public key is the same as used for this record.
	* IPv4 network		* IPv4 network
	** label (6 bytes):		** label (6 bytes):

Admin: /* Anonet importing rules */

2013-11-07T22:24:33Z

Anonet importing rules

← Older revision		Revision as of 00:24, 8 November 2013
Line 162:		Line 162:
	* IPv4 network resources: resources with a label length other than 6, with a network not in 1.0.0.0/8 (label[1] != 1) or a prefix length other than 24 (label[4] != 24) should be ignored		* IPv4 network resources: resources with a label length other than 6, with a network not in 1.0.0.0/8 (label[1] != 1) or a prefix length other than 24 (label[4] != 24) should be ignored
	* IPv6 network resources: resources with a label length other than 18, with a network not in fd::/8 (label[1] != 0xfd) or a prefix length other than 48 or 64 (label[17] != 48 && label[17] != 64) should be ignored		* IPv6 network resources: resources with a label length other than 18, with a network not in fd::/8 (label[1] != 0xfd) or a prefix length other than 48 or 64 (label[17] != 48 && label[17] != 64) should be ignored
	* Domain resources: ~~invalid~~ domain ~~names~~ should be ~~ignored~~, domain ~~names containing~~ non-ASCII ~~characters~~ or uppercase characters ~~should be ignored,~~ it is recommended that an implementation has a configurable list of parent domains under which domain names can be imported, and that only domains directly under a parent domain are imported; this list should contain the .ano tld, so that .ano can be claimed but not .*.ano.		* Domain resources: the domain name should not be empty and should be a valid fully qualified domain name without trailing dot, the domain name should not contain non-ASCII or uppercase characters; it is recommended that an implementation has a configurable list of parent domains under which domain names can be imported, and that only domains directly under a parent domain are imported; this list should contain the .ano tld, so that .ano can be claimed but not .*.ano.

Admin: /* Anonet resource encoding */

2013-11-07T22:16:28Z

Anonet resource encoding

← Older revision		Revision as of 00:16, 8 November 2013
Line 152:		Line 152:
	*** 'owner': optional, string, free text, name of owner		*** 'owner': optional, string, free text, name of owner
	*** 'descr': optional, string, free text, description		*** 'descr': optional, string, free text, description
	*** '~~dns~~': ~~optional~~, collection containing dictionary items		*** 'ns': recommended, collection containing dictionary items
	**** '~~label~~': ~~optional,~~ string, part before the domain name~~, no terminating~~ dot ~~(do not confuse~~ with ~~the resource label!)~~		**** 'ns': string, part before the domain name without dot for in-zone nameservers having a glue record or a FQDN with a final dot for out-of-zone nameservers
	**** '~~type~~': ~~required~~, string, ~~DNS~~ record ~~type (A, AAAA, NS, MX, CNAME, PTR, TXT), bind format, upper case~~		**** 'glue4': optional, string, contains an IPv4 address in text representation to use as a glue record for the nameserver
	**** '~~data~~': ~~required~~, string, ~~DNS~~ record ~~data~~, ~~bind format~~		**** 'glue6': optional, string, contains an IPv6 address in text representation to use as a glue record for the nameserver
	**** ~~'ttl'~~: ~~optional~~, ~~numeric string~~, ~~number~~ of ~~seconds~~ this ~~record may~~ be ~~cached~~
			== Anonet importing rules ==
			An implementation is free to handle resources as it wishes. The following list provides recommendations for handling resources. If resources are to be ignored, an implementation may do so either during import into the MARC database, or when viewing and exporting to external systems like a DNS server.
			* Key identity resources: resources with a label length other than 33 or defining a key other than the signing key (label[1:32] != public key) should be ignored
			* IPv4 network resources: resources with a label length other than 6, with a network not in 1.0.0.0/8 (label[1] != 1) or a prefix length other than 24 (label[4] != 24) should be ignored
			* IPv6 network resources: resources with a label length other than 18, with a network not in fd::/8 (label[1] != 0xfd) or a prefix length other than 48 or 64 (label[17] != 48 && label[17] != 64) should be ignored
			* Domain resources: invalid domain names should be ignored, domain names containing non-ASCII characters or uppercase characters should be ignored, it is recommended that an implementation has a configurable list of parent domains under which domain names can be imported, and that only domains directly under a parent domain are imported; this list should contain the .ano tld, so that .ano can be claimed but not .*.ano.

Admin: /* Procedure for importing an update message */

2013-11-06T22:24:15Z

Procedure for importing an update message

Admin: /* Anonet resource encoding */

2013-11-06T16:14:12Z

Anonet resource encoding

← Older revision		Revision as of 18:14, 6 November 2013
Line 106:		Line 106:
	== Anonet resource encoding ==		== Anonet resource encoding ==
	The different resource types are encoded as follows:		The different resource types are encoded as follows:
			* Key identity
			** label (33 bytes)
			*** Resource type, 1 byte, value 0
			*** Public key, 32 bytes, this must be the same key as the key used to sign the resource, otherwise the resource should not be accepted
			** value: dictionary
			*** 'owner': optional, string, free text, name of owner
			*** 'descr': optional, string, free text, description
			*** 'seckey': optional, contains the first 32 bytes of the secret key of this key pair, use to improve deniability by not storing the key locally; the expanded secret key can be reconstructed by concatenating the public key to this data
			*** 'seckeyenc': optional, contains the first 32 bytes of the secret key encrypted as follows: secretkey XOR sha512(publickey + password), where password is an ASCII string chosen by the user and the public key is used as a salt
	* IPv4 network		* IPv4 network
	** label (6 bytes):		** label (6 bytes):

← Older revision		Revision as of 00:24, 7 November 2013
Line 27:		Line 27:

	== Procedure for importing an update message ==		== Procedure for importing an update message ==
			# recommended: if the update serial is lower than the current unix timestamp - 3652460*60 (1 year), ignore the update
	# recommended: if the update serial is higher than the current unix timestamp + 72460*60 (7 days), ignore the update		# recommended: if the update serial is higher than the current unix timestamp + 72460*60 (7 days), ignore the update
	~~# recommended: if the update serial is lower than the current unix timestamp - 3652460*60 (1 year), ignore the update~~
	# if a resource with the given label exists:		# if a resource with the given label exists:
	## if the current serial is higher than or equal to the update serial, ignore the update		## if the current serial is higher than or equal to the update serial, ignore the update
	## if ~~the current status is not set to released and~~ the key in the update is different from the current key ~~and~~ (the transfer-to-key extension is not set or the transfer-to-key extension value does not match the key in the update), ignore the update		## if the key in the update is different from the current key AND the current serial is not lower than the current unix timestamp - 3652460*60 (1 year) AND (the expiration timestamp is not set OR the expiration timestamp is not lower than the current unix timestamp) AND (the transfer-to-key extension is not set or the transfer-to-key extension value does not match the key in the update), ignore the update
	# optional: if the update is too big (per node configuration), ignore the update		# optional: if the update is too big (per node configuration), ignore the update
	# optional: if the label is not acceptable (e.g. does not represent a valid IP network, AS number or domain name; node specific policy), ignore the update		# optional: if the label is not acceptable (e.g. does not represent a valid IP network, AS number or domain name; node specific policy), ignore the update
Line 38:		Line 38:
	# optional: import the resource value into existing data structures (e.g. configuration file, resdb, SQL database)		# optional: import the resource value into existing data structures (e.g. configuration file, resdb, SQL database)
	# store update message in the local database, identified/indexed by its label		# store update message in the local database, identified/indexed by its label
			## resources having a serial lower than the current unix timestamp - 3652460*60 (1 year) or an expiration timestamp lower than the current unix timestamp may be deleted from the local database instead, or may be deleted as part of a periodic database maintenance job

	== Layout of an update message ==		== Layout of an update message ==