RFC 1918 is the RFC in question that describes the privrate address space, but it doesn't describe or deal with CIDR, that's another RFC altogether (RFC1519 if anyone cares :)

As for 0's in IP address, there are two thing to avoid in IP addresses, that it all zeros or all ones, in either the host or the network address.

192.168.128.0 is invalid because it has all 0's in the host part (198.168.128 is the network, .0 is the host in a /24 (class C) space)
192.168.0.128 is valid because there is not all 0's or all 1's in either the network (192.168.0) or the host (.128).

Forgive me for the overly long and techinical explination, I've been doing large scale IP backbone stuff for 7 years now, so I just wanted to clear it up :)
-S