1 files changed, 161 insertions, 105 deletions

diff --git a/draft-schanzen-gns.txt b/draft-schanzen-gns.txt
index b44d435..dbfbae6 100644
--- a/draft-schanzen-gns.txt
+++ b/draft-schanzen-gns.txt
@@ -66,19 +66,20 @@ Table of Contents
      3.1.  PKEY  . . . . . . . . . . . . . . . . . . . . . . . . . .   5
      3.2.  GNS2DNS . . . . . . . . . . . . . . . . . . . . . . . . .   6
      3.3.  LEHO  . . . . . . . . . . . . . . . . . . . . . . . . . .   6
-     3.4.  BOX . . . . . . . . . . . . . . . . . . . . . . . . . . .   7
+     3.4.  NICK  . . . . . . . . . . . . . . . . . . . . . . . . . .   7
+     3.5.  BOX . . . . . . . . . . . . . . . . . . . . . . . . . . .   7
    4.  Publishing records  . . . . . . . . . . . . . . . . . . . . .   8
      4.1.  Key derivations . . . . . . . . . . . . . . . . . . . . .   8
      4.2.  Resource records block  . . . . . . . . . . . . . . . . .   9
-     4.3.  Block data encryption and decryption  . . . . . . . . . .  10
+     4.3.  Block data encryption and decryption  . . . . . . . . . .  11
    5.  Internationalization and Character Encoding . . . . . . . . .  13
    6.  Record Resolution . . . . . . . . . . . . . . . . . . . . . .  13
-     6.1.  Entry Zone  . . . . . . . . . . . . . . . . . . . . . . .  13
-     6.2.  Recursive Resolution  . . . . . . . . . . . . . . . . . .  13
-   7.  Namespace Revocation  . . . . . . . . . . . . . . . . . . . .  13
-   8.  Security Considerations . . . . . . . . . . . . . . . . . . .  13
-   9.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  13
-   10. Test Vectors  . . . . . . . . . . . . . . . . . . . . . . . .  13
+     6.1.  Entry Zone  . . . . . . . . . . . . . . . . . . . . . . .  14
+     6.2.  Recursive Resolution  . . . . . . . . . . . . . . . . . .  14
+   7.  Namespace Revocation  . . . . . . . . . . . . . . . . . . . .  14
+   8.  Security Considerations . . . . . . . . . . . . . . . . . . .  14
+   9.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  14
+   10. Test Vectors  . . . . . . . . . . . . . . . . . . . . . . . .  14
    11. Normative References  . . . . . . . . . . . . . . . . . . . .  16
    Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  17
 
@@ -104,8 +105,7 @@ Table of Contents
    some respects as even as an alternative to some of today's Public Key
    Infrastructures, in particular X.509 for the Web.
 
-   This document contains the GNU Name System (GNS) technical
-   specification of the GNU Name System (GNS), a fully decentralized and
+
 
 
 
@@ -114,6 +114,8 @@ Schanzenbach, et al.     Expires 24 January 2020                [Page 2]
 Internet-Draft             The GNU Name System                 July 2019
 
 
+   This document contains the GNU Name System (GNS) technical
+   specification of the GNU Name System (GNS), a fully decentralized and
    censorship-resistant name system.  GNS provides a privacy-enhancing
    alternative to the Domain Name System (DNS).  The design of GNS
    incorporates the capability to integrate and coexist with DNS.  GNS
@@ -163,8 +165,6 @@ Internet-Draft             The GNU Name System                 July 2019
 
 
 
-
-
 Schanzenbach, et al.     Expires 24 January 2020                [Page 3]
 
 Internet-Draft             The GNU Name System                 July 2019
@@ -352,7 +352,27 @@ Internet-Draft             The GNU Name System                 July 2019
    (e.g.  "Host:" header) it must be converted to a punycode
    representation [RFC3492].
 
-3.4.  BOX
+3.4.  NICK
+
+   Nickname records can be used by zone administrators to publish an
+   indication on what label this zone prefers to be referred to.  This
+   is a suggestion to other zones what label to use when creating a PKEY
+   Section 3.1 record containing this zone's public zone key.  A NICK
+   resource record contains an UTF-8 string (which is not 0-terminated)
+   representing the preferred label.  This string may NOT inlcude a ".".
+   A NICK DATA entry has the following format:
+
+              0     8     16    24    32    40    48    56
+              +-----+-----+-----+-----+-----+-----+-----+-----+
+              |                  NICKNAME                     |
+              /                                               /
+              /                                               /
+              |                                               |
+              +-----+-----+-----+-----+-----+-----+-----+-----+
+
+                                  Figure 6
+
+3.5.  BOX
 
    In GNS, every "." in a name delegates to another zone, and GNS
    lookups are expected to return all of the required useful information
@@ -366,6 +386,14 @@ Internet-Draft             The GNU Name System                 July 2019
    received, a GNS resolver must unbox it if the name to be resolved
    continues with "_SERVICE._PROTO", otherwise it is to be left
    untouched.  This way, TLSA (and SRV) records do not require a
+
+
+
+Schanzenbach, et al.     Expires 24 January 2020                [Page 7]
+
+Internet-Draft             The GNU Name System                 July 2019
+
+
    separate network request, and TLSA records become inseparable from
    the corresponding address records.  A BOX DATA entry has the
    following format:
@@ -380,20 +408,11 @@ Internet-Draft             The GNU Name System                 July 2019
               |                                               |
               +-----+-----+-----+-----+-----+-----+-----+-----+
 
-                                  Figure 6
+                                  Figure 7
 
    PROTO  the 16-bit protocol number, e.g. 6 for tcp.  In network byte
       order.
 
-
-
-
-
-Schanzenbach, et al.     Expires 24 January 2020                [Page 7]
-
-Internet-Draft             The GNU Name System                 July 2019
-
-
    SVC  the 16-bit service value of the boxed record, i.e. the port
       number.  In network byte order.
 
@@ -422,6 +441,15 @@ Internet-Draft             The GNU Name System                 July 2019
             q := SHA512 (zk_h)
 
    We use a hash-based key derivation function (HKDF) as defined in
+
+
+
+
+Schanzenbach, et al.     Expires 24 January 2020                [Page 8]
+
+Internet-Draft             The GNU Name System                 July 2019
+
+
    [RFC5869].  We use HMAC-SHA512 for the extraction phase and HMAC-
    SHA256 for the expansion phase.
 
@@ -443,13 +471,6 @@ Internet-Draft             The GNU Name System                 July 2019
    zk_h  is a 256-bit public key derived from the zone key "zk" using
       the keying material "h".
 
-
-
-Schanzenbach, et al.     Expires 24 January 2020                [Page 8]
-
-Internet-Draft             The GNU Name System                 July 2019
-
-
    L  is the prime-order subgroup as defined in Section 2.
 
    q  Is the 512-bit DHT key under which the resource records block is
@@ -470,6 +491,21 @@ Internet-Draft             The GNU Name System                 July 2019
    refresh publication.  A GNS resource records block has the following
    format:
 
+
+
+
+
+
+
+
+
+
+
+Schanzenbach, et al.     Expires 24 January 2020                [Page 9]
+
+Internet-Draft             The GNU Name System                 July 2019
+
+
               0     8     16    24    32    40    48    56
               +-----+-----+-----+-----+-----+-----+-----+-----+
               |                   SIGNATURE                   |
@@ -495,17 +531,10 @@ Internet-Draft             The GNU Name System                 July 2019
               /                                               |
               +-----+-----+-----+-----+-----+-----+-----+-----+
 
-                                  Figure 7
+                                  Figure 8
 
    where:
 
-
-
-Schanzenbach, et al.     Expires 24 January 2020                [Page 9]
-
-Internet-Draft             The GNU Name System                 July 2019
-
-
    SIGNATURE  A 512-bit ECDSA deterministic signature compliant with
       [RFC6979].  The signature is computed over the data following the
       PUBLIC KEY field.  The signature is created using the derived
@@ -526,6 +555,13 @@ Internet-Draft             The GNU Name System                 July 2019
    PURPOSE  A 32-bit signature purpose flag.  This field MUST be 15 (in
       network byte order).
 
+
+
+Schanzenbach, et al.     Expires 24 January 2020               [Page 10]
+
+Internet-Draft             The GNU Name System                 July 2019
+
+
    EXPIRATION  Specifies when the resource records block expires and the
       encrypted block SHOULD be removed from the DHT and caches as it is
       likely stale.  However, applications MAY continue to use non-
@@ -546,22 +582,6 @@ Internet-Draft             The GNU Name System                 July 2019
    set RDATA into the BDATA field of a GNS record block.  The wire
    format of the RDATA looks as follows:
 
-
-
-
-
-
-
-
-
-
-
-
-Schanzenbach, et al.     Expires 24 January 2020               [Page 10]
-
-Internet-Draft             The GNU Name System                 July 2019
-
-
               0     8     16    24    32    40    48    56
               +-----+-----+-----+-----+-----+-----+-----+-----+
               |     RR COUNT          |        EXPIRA-        /
@@ -586,10 +606,18 @@ Internet-Draft             The GNU Name System                 July 2019
               /                     PADDING                   /
               /                                               /
 
-                                  Figure 8
+                                  Figure 9
 
    where:
 
+
+
+
+Schanzenbach, et al.     Expires 24 January 2020               [Page 11]
+
+Internet-Draft             The GNU Name System                 July 2019
+
+
    RR COUNT  A 32-bit value containing the number of variable-length
       resource records which are following after this field in network
       byte order.
@@ -609,15 +637,6 @@ Internet-Draft             The GNU Name System                 July 2019
    then use "zk_h" to compute "q" which is the query for the DHT.  Upon
    receiving a block from the DHT, the receiver first checks that the
    PUBLIC KEY field matches "zk_h".  Then, the client MUST verify the
-
-
-
-
-Schanzenbach, et al.     Expires 24 January 2020               [Page 11]
-
-Internet-Draft             The GNU Name System                 July 2019
-
-
    signature.  These steps are mandatory to prevent record spoofing and
    MUST be performed before decryption.
 
@@ -639,6 +658,22 @@ Internet-Draft             The GNU Name System                 July 2019
    "K" into a 256-bit AES [RFC3826] key and a 256-bit TWOFISH [TWOFISH]
    key:
 
+
+
+
+
+
+
+
+
+
+
+
+Schanzenbach, et al.     Expires 24 January 2020               [Page 12]
+
+Internet-Draft             The GNU Name System                 July 2019
+
+
               0     8     16    24    32    40    48    56
               +-----+-----+-----+-----+-----+-----+-----+-----+
               |                    AES KEY                    |
@@ -652,7 +687,7 @@ Internet-Draft             The GNU Name System                 July 2019
               |                                               |
               +-----+-----+-----+-----+-----+-----+-----+-----+
 
-                                  Figure 9
+                                 Figure 10
 
    Similarly, we divide "IV" into a 128-bit initialization vector and a
    128-bit initialization vector:
@@ -666,15 +701,7 @@ Internet-Draft             The GNU Name System                 July 2019
               |                                               |
               +-----+-----+-----+-----+-----+-----+-----+-----+
 
-
-
-
-Schanzenbach, et al.     Expires 24 January 2020               [Page 12]
-
-Internet-Draft             The GNU Name System                 July 2019
-
-
-                                 Figure 10
+                                 Figure 11
 
    The keys and IVs are used for a CFB128-AES-256 and CFB128-TWOFISH-256
    chained symmetric cipher.  Both ciphers are used in Cipher FeedBack
@@ -694,6 +721,15 @@ Internet-Draft             The GNU Name System                 July 2019
 
    TODO
 
+
+
+
+
+Schanzenbach, et al.     Expires 24 January 2020               [Page 13]
+
+Internet-Draft             The GNU Name System                 July 2019
+
+
 6.1.  Entry Zone
 
    There are three sources from which the entry zone can be determined:
@@ -723,13 +759,6 @@ Internet-Draft             The GNU Name System                 July 2019
    The following represents a test vector for a record of type MX with a
    priority of 10 and the mail hostname mail.example.com.
 
-
-
-Schanzenbach, et al.     Expires 24 January 2020               [Page 13]
-
-Internet-Draft             The GNU Name System                 July 2019
-
-
           label := "mail"
 
           d :=
@@ -749,6 +778,14 @@ Internet-Draft             The GNU Name System                 July 2019
           f2dbf7930be76fb9
           5e7c80b1416f8ca6
           dc50ce8e1fb759b9
+
+
+
+Schanzenbach, et al.     Expires 24 January 2020               [Page 14]
+
+Internet-Draft             The GNU Name System                 July 2019
+
+
           fedcdcf546c17e9b
           4c4f23632855c053
           6668e9f684f4dc33
@@ -778,14 +815,6 @@ Internet-Draft             The GNU Name System                 July 2019
 
           AES_IV :=
           a808b929bc9fad7a
-
-
-
-Schanzenbach, et al.     Expires 24 January 2020               [Page 14]
-
-Internet-Draft             The GNU Name System                 July 2019
-
-
           686bbe3432bed77a
 
           TWOFISH_KEY :=
@@ -805,6 +834,14 @@ Internet-Draft             The GNU Name System                 July 2019
           000a046d61696c07 Priority (10) |4 | mail | 7
           6578616d706c6503 example | 3
           636f6d0000000000 com | \0 | Followed by
+
+
+
+Schanzenbach, et al.     Expires 24 January 2020               [Page 15]
+
+Internet-Draft             The GNU Name System                 July 2019
+
+
           0000000000000000 24 bytes of padding to 2^6
           0000000000000000
           00000000
@@ -835,13 +872,6 @@ Internet-Draft             The GNU Name System                 July 2019
           001fd19a6406a721
           713f0a0d
 
-
-
-Schanzenbach, et al.     Expires 24 January 2020               [Page 15]
-
-Internet-Draft             The GNU Name System                 July 2019
-
-
 11.  Normative References
 
    [RFC1034]  Mockapetris, P., "Domain names - concepts and facilities",
@@ -861,6 +891,13 @@ Internet-Draft             The GNU Name System                 July 2019
               10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November
               2003, <https://www.rfc-editor.org/info/rfc3629>.
 
+
+
+Schanzenbach, et al.     Expires 24 January 2020               [Page 16]
+
+Internet-Draft             The GNU Name System                 July 2019
+
+
    [RFC3826]  Blumenthal, U., Maino, F., and K. McCloghrie, "The
               Advanced Encryption Standard (AES) Cipher Algorithm in the
               SNMP User-based Security Model", RFC 3826,
@@ -890,14 +927,6 @@ Internet-Draft             The GNU Name System                 July 2019
               for Security", RFC 7748, DOI 10.17487/RFC7748, January
               2016, <https://www.rfc-editor.org/info/rfc7748>.
 
-
-
-
-Schanzenbach, et al.     Expires 24 January 2020               [Page 16]
-
-Internet-Draft             The GNU Name System                 July 2019
-
-
    [RFC8032]  Josefsson, S. and I. Liusvaara, "Edwards-Curve Digital
               Signature Algorithm (EdDSA)", RFC 8032,
               DOI 10.17487/RFC8032, January 2017,
@@ -917,6 +946,14 @@ Authors' Addresses
    Email: schanzen@gnunet.org
 
 
+
+
+
+Schanzenbach, et al.     Expires 24 January 2020               [Page 17]
+
+Internet-Draft             The GNU Name System                 July 2019
+
+
    Christian Grothoff
    Berner Fachhochschule
    Hoeheweg 80
@@ -949,4 +986,23 @@ Authors' Addresses
 
 
 
-Schanzenbach, et al.     Expires 24 January 2020               [Page 17]
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Schanzenbach, et al.     Expires 24 January 2020               [Page 18]