<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">When there’s no DNSSEC KEY with SEP bit set, the Algo-13 “chain” has single entry point, e.g. Single-Type Signing Scheme (Combined Signing Key), see <a href="https://tools.ietf.org/html/rfc6781#section-3.1">https://tools.ietf.org/html/rfc6781#section-3.1</a> and <a href="https://tools.ietf.org/html/rfc8499#section-10">https://tools.ietf.org/html/rfc8499#section-10</a><br><br>I don’t know exactly know what are you trying achieve, but adding only ZSK with new algorithm serves no purpose.<br><br>Ondřej<br><div dir="ltr"><div>--</div>Ondřej Surý — ISC</div><div dir="ltr"><br><blockquote type="cite">On 11 Aug 2019, at 12:59, Mark Elkins <mje@posix.co.za> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><span>Hi, Running BIND 9.14.4 on Gentoo.</span><br><span></span><br><span>I've been running BIND and DNSSEC for a long time. Years ago - I changed from Algorithm 5 to 8 and am now changing from 8 to 13.</span><br><span></span><br><span>My ZSK's have a lifetime of 34 days and my KSK a lifetime of 370 days. I've chosen to create a new ZSK every 17 days and KSK every 185 days - so usually have two of each per domain. I've 1532 domains in my system, 74 are NSEC and 54 are NSEC3 - the rest are unsigned. Currently - resigning happens randomly over the year - which keeps loads (and changes) scattered over the year. Some parents - I manage via EPP, others have various other methods of updating - so having the best part of six month to do a key-rollover has its advantages.</span><br><span></span><br><span>I've just started allowing the system to add Algo-13 Keys... and this is what I see:</span><br><span></span><br><span>1 - Created a test zone file: contains enough to be legal.</span><br><span></span><br><span>2 - Created some old keys, one ZSK and one KSK - Signed the domain and looked inside the "dsset-" file....</span><br><span> # vi db.foo.com</span><br><span> # dnssec-keygen -a RSASHA256 foo.com</span><br><span> # dnssec-keygen -a RSASHA256 -f KSK foo.com</span><br><span> # cat Kfoo.com.*.key >> db.foo.com</span><br><span> # dnssec-signzone -a -o foo.com db.foo.com</span><br><span> # cat dsset-foo.com.</span><br><span>foo.com. IN DS 62014 8 1 6CFC9114C7D0954195C01B488C3B8D6E1BD0F220</span><br><span>foo.com. IN DS 62014 8 2 74112FE6AE6E9DFB5A00EB3C26397E92CAA27038FA176A9B4B67D9FE 4E0154FE</span><br><span>(perfect!)</span><br><span></span><br><span>3 - created one additional ZSK - Algo 13, add that to the zone and resigned.</span><br><span></span><br><span> # dnssec-keygen -a ECDSAP256SHA256 foo.com</span><br><span> # cat Kfoo.com.+013+34805.key >> db.foo.com</span><br><span></span><br><span> # dnssec-signzone -a -o foo.com db.foo.com</span><br><span>Verifying the zone using the following algorithms: RSASHA256.</span><br><span>Missing self-signed KSK for algorithm ECDSAP256SHA256</span><br><span>The zone is not fully signed for the following algorithms: ECDSAP256SHA256.</span><br><span>DNSSEC completeness test failed.</span><br><span>Zone verification failed (failure)</span><br><span></span><br><span>I don't mind the failure - after all there is no complete Algo-13 chain - but the existing Algo-8 chain is complete. Interestingly, the signed zone contains no mention of the Algo-13 ZSK. No problem.</span><br><span></span><br><span>However - WTF is a ZSK doing in the dsset file??? Is this a bug?</span><br><span></span><br><span># cat dsset-foo.com.</span><br><span>foo.com. IN DS 34805 13 1 A040C7BC6C03778B20AD4A3AEE3BC0648CE8AC23</span><br><span>foo.com. IN DS 34805 13 2 340DC924A523CAD49E5C22357BBFECC07A2944D7723AD8F44DCE5332 FACD3AB2</span><br><span>foo.com. IN DS 62014 8 1 6CFC9114C7D0954195C01B488C3B8D6E1BD0F220</span><br><span>foo.com. IN DS 62014 8 2 74112FE6AE6E9DFB5A00EB3C26397E92CAA27038FA176A9B4B67D9FE 4E0154FE</span><br><span></span><br><span>4 - If I then add an algo-13 KSK, add it to the Zone and run signzone - everything looks good again...</span><br><span></span><br><span>(New KSK) foo.com. IN DNSKEY 257 3 13 pD6yMHdPCKmLj0hY8oiLA1F2Vdb8a1LgpzU8XiO2c6eIh16n1Dv2Vogc 9WylTUjOLTZlhRXPDmAcIUTyBUuC2Q==</span><br><span># dnssec-signzone -a -o foo.com db.foo.com</span><br><span>Verifying the zone using the following algorithms: RSASHA256 ECDSAP256SHA256.</span><br><span>Zone fully signed:</span><br><span>Algorithm: RSASHA256: KSKs: 1 active, 0 stand-by, 0 revoked</span><br><span> ZSKs: 1 active, 0 stand-by, 0 revoked</span><br><span>Algorithm: ECDSAP256SHA256: KSKs: 1 active, 0 stand-by, 0 revoked</span><br><span> ZSKs: 1 active, 0 stand-by, 0 revoked</span><br><span>db.foo.com.signed</span><br><span># cat dsset-foo.com.</span><br><span>foo.com. IN DS 23294 13 1 AADE5856B8EB3BB946DAAD2804A735816B3B3132</span><br><span>foo.com. IN DS 23294 13 2 7FD5F02A2E52A1C6E3DEBD54C05A9A974CE88FA78548E3644B36FA2D 27E0F910</span><br><span>foo.com. IN DS 62014 8 1 6CFC9114C7D0954195C01B488C3B8D6E1BD0F220</span><br><span>foo.com. IN DS 62014 8 2 74112FE6AE6E9DFB5A00EB3C26397E92CAA27038FA176A9B4B67D9FE 4E0154FE</span><br><span></span><br><span>I really don't like the bad ZSK DS record in dsset because I currently use that info to build CDS records in to my Database - which is used to verify when the DS record is seen in the parent. Anyway - I think this is a bug in the code of dnssec-signzone.</span><br><span></span><br><span>I'm trying to wait as long as possible before forcibly creating Algo-13 KSK's in the hope that they will be created according to the existing schedule. If the Second Algo-13 ZSK is to be created in under 3 days - then I'll replace the oldest KSK with an Algo-13 KSK.</span><br><span></span><br><span>-- </span><br><span>Mark James ELKINS - Posix Systems - (South) Africa</span><br><span>mje@posix.co.za Tel: +27.128070590 Cell: +27.826010496</span><br><span>For fast, reliable, low cost Internet in ZA: https://ftth.posix.co.za</span><br><span></span><br><span>_______________________________________________</span><br><span>Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list</span><br><span></span><br><span>bind-users mailing list</span><br><span>bind-users@lists.isc.org</span><br><span>https://lists.isc.org/mailman/listinfo/bind-users</span><br></div></blockquote></body></html>