|
Network Working Group Request for Comments: 4471 Category: Experimental |
G. Sisson B. Laurie Nominet September 2006 |
This memo defines an Experimental Protocol for the Internet community. It does not specify an Internet standard of any kind. Discussion and suggestions for improvement are requested. Distribution of this memo is unlimited.
Copyright © The Internet Society (2006).
This document describes two methods for deriving the canonically- ordered predecessor and successor of a DNS name. These methods may be used for dynamic NSEC resource record synthesis, enabling security-aware name servers to provide authenticated denial of existence without disclosing other owner names in a DNSSEC secured zone.
1. Introduction
2. Notational Conventions
3. Derivations
3.1. Absolute Method
3.1.1. Derivation of DNS Name Predecessor
3.1.2. Derivation of DNS Name Successor
3.2. Modified Method
3.2.1. Derivation of DNS Name Predecessor
3.2.2. Derivation of DNS Name Successor
4. Notes
4.1. Test for Existence
4.2. Case Considerations
4.3. Choice of Range
4.4. Wild Card Considerations
4.5. Possible Modifications
4.5.1. Restriction of Effective Maximum DNS Name Length
4.5.2. Use of Modified Method with Zones Containing
SRV RRs
5. Examples
5.1. Examples of Immediate Predecessors Using Absolute Method ..10
5.2. Examples of Immediate Successors Using Absolute Method
5.3. Examples of Predecessors Using Modified Method
5.4. Examples of Successors Using Modified Method
6. Security Considerations
7. Acknowledgements
8. References
8.1. Normative References
8.2. Informative References
One of the proposals for avoiding the exposure of zone information during the deployment DNSSEC is dynamic NSEC resource record (RR) synthesis. This technique is described in [DNSSEC-TRANS] and [RFC4470], and involves the generation of NSEC RRs that just span the query name for non-existent owner names. In order to do this, the DNS names that would occur just prior to and just following a given query name must be calculated in real time, as maintaining a list of all possible owner names that might occur in a zone would be impracticable.
Section 6.1 of [RFC4034] defines canonical DNS name order. This document does not amend or modify this definition. However, the derivation of immediate predecessor and successor, although trivial, is non-obvious. Accordingly, several methods are described here as an aid to implementors and a reference to other interested parties.
This document describes two methods:
The following notational conventions are used in this document for economy of expression:
N: An unspecified DNS name.
P(N): Immediate predecessor to N (absolute method).
S(N): Immediate successor to N (absolute method).
P'(N): Predecessor to N (modified method).
S'(N): Successor to N (modified method).
These derivations assume that all uppercase US-ASCII letters in N have already been replaced by their corresponding lowercase equivalents. Unless otherwise specified, processing stops after the first step in which a condition is met.
The derivations make reference to maximum label length and maximum DNS name length; these are defined in Section 3.1 of [RFC1034] to be 63 and 255 octets, respectively.
To derive P(N):
the least significant (left-most) label with as many octets as possible of the maximum sort value. Proceed to the next step.
To derive S(N):
This method is for use with zones consisting only of single-label owner names where an owner name consisting of label of maximum length would not result in a DNS name that exceeded the maximum DNS name length. This method is computationally simpler and returns values that are more economical in size than the absolute method. It differs from the absolute method detailed above in the following ways:
To derive P'(N):
To derive S'(N):
Before using the result of P(N) or P'(N) as the owner name of an NSEC RR in a DNS response, a name server should test to see whether the name exists. If it does, either a standard non-synthesised NSEC RR should be used, or the synthesised NSEC RR should reflect the RRset types that exist at the NSEC RR's owner name in the Type Bit Map field as specified by Section 4.1.2 of [RFC4034]. Implementors will likely find it simpler to use a non-synthesised NSEC RR. For further details, see Section 2 of [RFC4470].
Section 3.5 of [RFC1034] specifies that "while upper and lower case letters are allowed in names, no significance is attached to the case". Additionally, Section 6.1 of [RFC4034] states that when determining canonical DNS name order, "uppercase US-ASCII letters are treated as if they were lowercase US-ASCII letters". Consequently, values corresponding to US-ASCII uppercase letters must be skipped when decrementing and incrementing octets in the derivations described in Section 3.
The following pseudo-code is illustrative:
Decrement the value of an octet:
if (octet == '[') // '[' is just after uppercase 'Z'
octet = '@'; // '@' is just prior to uppercase 'A'
else
octet--;
Increment the value of an octet:
if (octet == '@') // '@' is just prior to uppercase 'A'
octet = '['; // '[' is just after uppercase 'Z'
else
octet++;
[RFC2181] makes the clarification that "any binary string whatever can be used as the label of any resource record". Consequently, the minimum sort value may be set as 0x00 and the maximum sort value as 0xff, and the range of possible values will be any DNS name that contains octets of any value other than those corresponding to uppercase US-ASCII letters.
However, if all owner names in a zone are in the letter-digit-hyphen, or LDH, format specified in [RFC1034], it may be desirable to restrict the range of possible values to DNS names containing only LDH values. This has the effect of
This may be accomplished by using a minimum sort value of 0x1f (US- ASCII character `-') and a maximum sort value of 0x7a (US-ASCII character lowercase `z'), and then skipping non-LDH, non-lowercase values when incrementing or decrementing octets.
Neither derivation avoids the possibility that the result may be a DNS name containing a wildcard label, i.e., a label containing a single octet with the value 0x2a (US-ASCII character `*'). With additional tests, wildcard DNS names may be explicitly avoided; alternatively, if the range of octet values can be restricted to those corresponding to letter-digit-hyphen, or LDH, characters (see Section 4.3), such DNS names will not occur.
Note that it is improbable that a result that is a wildcard DNS name will occur unintentionally; even if one does occur either as the owner name of, or in the RDATA of an NSEC RR, it is treated as a literal DNS name with no special meaning.
[RFC1034] specifies that "the total number of octets that represent a name (i.e., the sum of all label octets and label lengths) is limited to 255", including the null (zero-length) label that represents the root. For the purpose of deriving predecessors and successors during NSEC RR synthesis, the maximum DNS name length may be effectively restricted to the length of the longest DNS name in the zone. This will minimise the size of responses containing synthesised NSEC RRs but, especially in the case of the modified method, may result in some additional computational complexity.
Note that this modification will have the effect of revealing information about the longest name in the zone. Moreover, when the contents of the zone changes, e.g., during dynamic updates and zone transfers, care must be taken to ensure that the effective maximum DNS name length agrees with the new contents.
Normally, the modified method cannot be used in zones that contain Service Record (SRV) RRs [RFC2782], as SRV RRs have owner names that contain multiple labels. However, the use of SRV RRs can be
accommodated by various techniques. There are at least four possible ways to do this:
This approach would make it possible to enumerate all DNS names in the zone containing a first-level label beginning with underscore, including all SRV RRs, but this may be of less a concern to the zone administrator than incurring the overhead of the absolute method or of the following variants of the modified method.
In the following examples,
the owner name of the zone apex is "example.com.",
the range of octet values is 0x00 - 0xff excluding values corresponding to uppercase US-ASCII letters, and
non-printable octet values are expressed as three-digit decimal numbers preceded by a backslash (as specified in Section 5.1 of [RFC1035]).
Example of a typical case:
P(foo.example.com.) =
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255.\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255.\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255.fon\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255.example.com.
or, in alternate notation:
\255{49}.\255{63}.\255{63}.fon\255{60}.example.com.
where {n} represents the number of repetitions of an octet.
Example where least significant (left-most) label of DNS name consists of a single octet of the minimum sort value:
P(\000.foo.example.com.) = foo.example.com.
Example where least significant (right-most) octet of least significant (left-most) label has the minimum sort value:
P(foo\000.example.com.) =
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255.\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255.\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255.\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255.foo.example.com.
or, in alternate notation:
\255{45}.\255{63}.\255{63}.\255{63}.foo.example.com.
Example where DNS name contains an octet that must be decremented by skipping values corresponding to US-ASCII uppercase letters:
P(fo\[.example.com.) =
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255.\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255.\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255.fo\@\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255.example.com.
or, in alternate notation:
\255{49}.\255{63}.\255{63}.fo\@\255{60}.example.com.
where {n} represents the number of repetitions of an octet.
Example where DNS name is the owner name of the zone apex, and consequently wraps to the DNS name with the maximum possible sort order in the zone:
P(example.com.) =
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255.\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255.\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255.\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255.example.com.
or, in alternate notation:
\255{49}.\255{63}.\255{63}.\255{63}.example.com.
Example of typical case:
S(foo.example.com.) = \000.foo.example.com.
Example where DNS name is one octet short of the maximum DNS name length:
N = fooooooooooooooooooooooooooooooooooooooooooooooo
.ooooooooooooooooooooooooooooooooooooooooooooooo
oooooooooooooooo.ooooooooooooooooooooooooooooooo
oooooooooooooooooooooooooooooooo.ooooooooooooooo
oooooooooooooooooooooooooooooooooooooooooooooooo.example.com.
or, in alternate notation:
fo{47}.o{63}.o{63}.o{63}.example.com.
S(N) =
fooooooooooooooooooooooooooooooooooooooooooooooo
\000.ooooooooooooooooooooooooooooooooooooooooooo
oooooooooooooooooooo.ooooooooooooooooooooooooooo
oooooooooooooooooooooooooooooooooooo.ooooooooooo
oooooooooooooooooooooooooooooooooooooooooooooooo
oooo.example.com.
or, in alternate notation:
fo{47}\000.o{63}.o{63}.o{63}.example.com.
Example where DNS name is the maximum DNS name length:
N = fooooooooooooooooooooooooooooooooooooooooooooooo
o.oooooooooooooooooooooooooooooooooooooooooooooo
ooooooooooooooooo.oooooooooooooooooooooooooooooo
ooooooooooooooooooooooooooooooooo.oooooooooooooo
oooooooooooooooooooooooooooooooooooooooooooooooo
o.example.com.
or, in alternate notation:
fo{48}.o{63}.o{63}.o{63}.example.com.
S(N) =
fooooooooooooooooooooooooooooooooooooooooooooooo
p.oooooooooooooooooooooooooooooooooooooooooooooo
ooooooooooooooooo.oooooooooooooooooooooooooooooo
ooooooooooooooooooooooooooooooooo.oooooooooooooo
oooooooooooooooooooooooooooooooooooooooooooooooo
o.example.com.
or, in alternate notation:
fo{47}p.o{63}.o{63}.o{63}.example.com.
Example where DNS name is the maximum DNS name length and the least significant (left-most) label has the maximum sort value:
N = \255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255.ooooooooooooooooooooooooooooooooooooooooooo
oooooooooooooooooooo.ooooooooooooooooooooooooooo
oooooooooooooooooooooooooooooooooooo.ooooooooooo
oooooooooooooooooooooooooooooooooooooooooooooooo
oooo.example.com.
or, in alternate notation:
\255{49}.o{63}.o{63}.o{63}.example.com.
S(N) =
oooooooooooooooooooooooooooooooooooooooooooooooo
oooooooooooooop.oooooooooooooooooooooooooooooooo
ooooooooooooooooooooooooooooooo.oooooooooooooooo
ooooooooooooooooooooooooooooooooooooooooooooooo.
example.com.
or, in alternate notation:
o{62}p.o{63}.o{63}.example.com.
Example where DNS name is the maximum DNS name length and the eight least significant (right-most) octets of the least significant (left-most) label have the maximum sort value:
N = foooooooooooooooooooooooooooooooooooooooo\255
\255\255\255\255\255\255\255.ooooooooooooooooooo
oooooooooooooooooooooooooooooooooooooooooooo.ooo
oooooooooooooooooooooooooooooooooooooooooooooooo
oooooooooooo.ooooooooooooooooooooooooooooooooooo
oooooooooooooooooooooooooooo.example.com.
or, in alternate notation:
fo{40}\255{8}.o{63}.o{63}.o{63}.example.com.
S(N) =
fooooooooooooooooooooooooooooooooooooooop.oooooo
oooooooooooooooooooooooooooooooooooooooooooooooo
ooooooooo.oooooooooooooooooooooooooooooooooooooo
ooooooooooooooooooooooooo.oooooooooooooooooooooo
ooooooooooooooooooooooooooooooooooooooooo.example.com.
or, in alternate notation:
fo{39}p.o{63}.o{63}.o{63}.example.com.
Example where DNS name is the maximum DNS name length and contains an octet that must be incremented by skipping values corresponding to US-ASCII uppercase letters:
N = fooooooooooooooooooooooooooooooooooooooooooooooo
\@.ooooooooooooooooooooooooooooooooooooooooooooo
oooooooooooooooooo.ooooooooooooooooooooooooooooo
oooooooooooooooooooooooooooooooooo.ooooooooooooo
oooooooooooooooooooooooooooooooooooooooooooooooo
oo.example.com.
or, in alternate notation:
fo{47}\@.o{63}.o{63}.o{63}.example.com.
S(N) =
fooooooooooooooooooooooooooooooooooooooooooooooo
\[.ooooooooooooooooooooooooooooooooooooooooooooo
oooooooooooooooooo.ooooooooooooooooooooooooooooo
oooooooooooooooooooooooooooooooooo.ooooooooooooo
oooooooooooooooooooooooooooooooooooooooooooooooo
oo.example.com.
or, in alternate notation:
fo{47}\[.o{63}.o{63}.o{63}.example.com.
Example where DNS name has the maximum possible sort order in the zone, and consequently wraps to the owner name of the zone apex:
N = \255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255.\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255.\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255.\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255.example.com.
or, in alternate notation:
\255{49}.\255{63}.\255{63}.\255{63}.example.com.
S(N) = example.com.
Example of a typical case:
P'(foo.example.com.) =
fon\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255.example.com.
or, in alternate notation:
fon\255{60}.example.com.
Example where DNS name contains more labels than DNS names in the zone:
P'(bar.foo.example.com.) = foo.example.com.
Example where least significant (right-most) octet of least significant (left-most) label has the minimum sort value:
P'(foo\000.example.com.) = foo.example.com.
Example where least significant (left-most) label has the minimum sort value:
P'(\000.example.com.) = example.com.
Example where DNS name is the owner name of the zone apex, and consequently wraps to the DNS name with the maximum possible sort order in the zone:
P'(example.com.) =
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255.example.com.
or, in alternate notation:
\255{63}.example.com.
Example of a typical case:
S'(foo.example.com.) = foo\000.example.com.
Example where DNS name contains more labels than DNS names in the zone:
S'(bar.foo.example.com.) = foo\000.example.com.
Example where least significant (left-most) label has the maximum sort value, and consequently wraps to the owner name of the zone apex:
N = \255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255\255\255\255\255\255\255\255\255\255
\255\255\255.example.com.
or, in alternate notation:
\255{63}.example.com.
S'(N) = example.com.
The derivation of some predecessors/successors requires the testing of more conditions than others. Consequently, the effectiveness of a denial-of-service attack may be enhanced by sending queries that require more conditions to be tested. The modified method involves the testing of fewer conditions than the absolute method and consequently is somewhat less susceptible to this exposure.
The authors would like to thank Sam Weiler, Olaf Kolkman, Olafur Gudmundsson, and Niall O'Reilly for their review and input.
[RFC1034] Mockapetris, P., "Domain names - concepts and
facilities", STD 13, RFC 1034, November 1987.
[RFC1035] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, November 1987.
[RFC2181] Elz, R. and R. Bush, "Clarifications to the DNS
Specification", RFC 2181, July 1997.
[RFC2782] Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR
for specifying the location of services (DNS SRV)",
RFC 2782, February 2000.
[RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and
S. Rose, "Resource Records for the DNS Security
Extensions", RFC 4034, March 2005.
[RFC4470] Weiler, S. and J. Ihren, "Minimally Covering NSEC
Records and DNSSEC On-line Signing", RFC 4470, April
2006.
[DNSSEC-TRANS] Arends, R., Koch, P., and J. Schlyter, "Evaluating DNSSEC Transition Mechanisms", Work in Progress, February 2005.
Geoffrey Sisson
Nominet
Sandford Gate
Sandy Lane West
Oxford
OX4 6LB
GB
Phone: +44 1865 332211
EMail: geoff@nominet.org.uk
Ben Laurie
Nominet
17 Perryn Road
London
W3 7LR
GB
Phone: +44 20 8735 0686
EMail: ben@algroup.co.uk
Copyright © The Internet Society (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA).