Re: [DNSOP] Updated KSK Sentinel document

[Paul Hoffman]

On 12 Feb 2018, at 12:28, Warren Kumari wrote:


I also updated my demo implementation
(http://www.ksk-test.net) to use this naming scheme.


I would very much like to see draft-ietf-dnsop-kskroll-sentinel move 
forward, but was concerned that the result might be something where an 
end-user might not be able to reliably test the resolver they were using 
for it. Warren's Javascript code from that page uses the idea that an 
image that could not be loaded would have a height of zero:


  if (img_invalid.height === 0) {invalid = false;}
  if (img_is_ta.height === 0) {is_ta = false;}
  if (img_not_ta.height === 0) {not_ta = false;}

That seems to work for some browsers, but I worried that some browsers 
might implement something different for their Javascript. (This is not 
to knock Warren's code: he admitted it was a quick hack.)


After some investigation, I have a different method that should work in 
all browsers that follow the HTML and Javascript standards. It does not 
rely on any non-standard assumptions in the client-side Javascript.


In the  of an HTML document, first include something like this:
   var collected_names = [];
... to create a global variable that holds a list. Then include:
   src="http://kskroll-sentinel-is-ta-4f66.example.com/is-ta.js";>
   src="http://kskroll-sentinel-not-ta-4f66.example.com/not-ta.js";>

   http://invalid.example.com/invalid.js";>
The files that are attempted to be retrieved have one line of code, 
different for each file:

   collected_names.push("is_ta");
  or
   collected_names.push("not_ta");
  or
   collected_names.push("invalid");
The result is that the collected_names list now contains an entry for 
each of the domains where the .js file was fetchable. The Javascript (in 
yet another