<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0);">
Can do to provide instructions on how to follow the upcoming post quantum cryptography requirements?</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0);">
<a href="https://media.defense.gov/2022/Sep/07/2003071834/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF" id="LPlnkOWA27452638-8cb8-e248-c730-0b9a3df58da4" class="OWAAutoLink">CSA_CNSA_2.0_ALGORITHMS_.PDF (defense.gov)</a></div>
<div id="Signature" class="elementToProof">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0);">
It would be exteremely helpful. If the crypto is not ready yet, then please keep these standards in mind for future direction when available.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0);">
<br>
</div>
<p style="direction: ltr; margin-top: 0px; margin-bottom: 0px;"><span style="font-family: Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0);">RW</span></p>
<p style="direction: ltr; margin-top: 0px; margin-bottom: 0px;"><span style="font-family: Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0);"><br>
</span></p>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> bind-users <bind-users-bounces@lists.isc.org> on behalf of Matthijs Mekking <matthijs@isc.org><br>
<b>Sent:</b> Wednesday, October 16, 2024 4:03 AM<br>
<b>To:</b> bind-users@lists.isc.org <bind-users@lists.isc.org><br>
<b>Subject:</b> Re: DNSSEC algo rollover fails to delete old keys</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">This email originated from outside of TESLA<br>
<br>
Do not click links or open attachments unless you recognize the sender and know the content is safe.<br>
<br>
If you provide the output of `rndc dnssec -status` it might give a hint<br>
why the keys are still published.<br>
<br>
I suspect that BIND needs to be told that the DS has been withdrawn for<br>
the parent zone (assuming you don't have parental-agents set up).<br>
<br>
For future algorithm rollovers: You can just change from "algo8" to<br>
"algo13", no need to have an intermittent "algo8-13" policy.<br>
<br>
Best regards,<br>
<br>
Matthijs<br>
<br>
On 10/16/24 02:54, Arnold DECHAMPS wrote:<br>
> Hello everyone,<br>
><br>
> I made a algo rollover in DNSSEC from algo 8 to algo 13.<br>
><br>
> Software version : 9.18.28-1~deb12u2-Debian<br>
><br>
> My zone configuration refers to policies :<br>
><br>
> ==========================================================================<br>
><br>
> dnssec-policy "algo8" {<br>
> keys {<br>
> ksk lifetime unlimited algorithm rsasha256;<br>
> zsk lifetime 30d algorithm rsasha256;<br>
> };<br>
> max-zone-ttl 1d;<br>
> signatures-validity 14d;<br>
> signatures-refresh 7d;<br>
> };<br>
><br>
> dnssec-policy "algo13" {<br>
> keys {<br>
> ksk lifetime unlimited algorithm 13;<br>
> zsk lifetime 30d algorithm 13;<br>
> };<br>
> max-zone-ttl 1d;<br>
> signatures-validity 14d;<br>
> signatures-refresh 7d;<br>
> };<br>
><br>
> dnssec-policy "algo8-13" {<br>
> keys {<br>
> ksk lifetime unlimited algorithm rsasha256; // Old Algo<br>
> zsk lifetime 30d algorithm rsasha256; // Old Algo<br>
> ksk lifetime unlimited algorithm 13; // New Algo<br>
> zsk lifetime 30d algorithm 13; // New Algo<br>
> };<br>
> max-zone-ttl 1d;<br>
> signatures-validity 14d;<br>
> signatures-refresh 7d;<br>
> };<br>
><br>
> ==========================================================================<br>
><br>
> The zone config looks like :<br>
><br>
> ==========================================================================<br>
><br>
> zone "somedomain.com"{<br>
> ...<br>
> inline-signing yes;<br>
> dnssec-policy "algo13";<br>
> key-directory "/etc/bind/keys";<br>
> };<br>
><br>
> ==========================================================================<br>
><br>
><br>
> The initial idea was to switch the config of the domains that had to be<br>
> rolled over to algo8-13 and temporarily have both keys in the zone<br>
> waiting for the TTL of the DS records to expire. This was successful and<br>
> algo 13 is now in use. I then switched to the algo13 policy and deleted<br>
> the algo 8 keys of my keys directory.<br>
><br>
> At this point, Bind sees that all the algo 8 keys are expired. It also<br>
> see's that it can't find the files anymore (which prevents me from using<br>
> dnssec-settime as far as I know).<br>
><br>
> ==========================================================================<br>
> dns_dnssec_keylistfromrdataset: error reading<br>
> /etc/bind/keys/Ksomedomain.com.+008+16000.private: file not found<br>
> dns_dnssec_findzonekeys2: error reading<br>
> /etc/bind/keys/Ksomedomain.com.+008+16000.private: file not found<br>
> ==========================================================================<br>
><br>
> It stills publishes the DNSKEY in the signed zone. I would like to<br>
> ideally correct this by forcing bind to discard the old keys. Is this<br>
> possible to do? And if yes, how?<br>
><br>
> Regards,<br>
><br>
> Arnold<br>
--<br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://www.isc.org/contact/">https://www.isc.org/contact/</a> for more information.<br>
<br>
<br>
bind-users mailing list<br>
bind-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</div>
</span></font></div>
</body>
</html>