Re: [dnsext] Clarifying the mandatory algorithm rules

[Ondřej Surý <[e-mail]>]

On 18.11.2010 22:02, Brian Dickson wrote:
> I think there is wiggle room for the addition of new DNSKEYs and
> algorithms, via the ZSK/KSK linkage, that differs slightly.

Indeed.  But I see that as a variation of "must have a chain of trust" 
and relation between DS(parent)-DNSKEY(child).

> I.e. KSK must match DS for algorithms, and ZSK must match RRSIG for
> algorithms. It is possible that algorithms present in ZSKs are not
> present in KSKs.

Although bind doesn't treat this case as a valid zone and 
dnssec-signzone has to be silenced with -P, I was unable to find the 
reference to invalidity of such zone neither in 403[3-5] nor 3757.  That 
doesn't mean it doesn't exists, just that I didn't find it.

> And in such a case, unbound is correct and bind is incorrect, IMHO.

My feeling is that the same rule about DS-DNSKEY should apply for 
KSK-ZSK.  So if you publish a ZSK(A) and ZSK(B) and sign them with your 
KSK, you have to have RRSIG(ZSK(A)) and RRSIG(ZSK(B)) over all RRs in 
your zone.

O.
-- 
  Ondřej Surý
  vedoucí výzkumu/Head of R&D department
  -------------------------------------------
  CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
  Americka 23, 120 00 Praha 2, Czech Republic
  mailto:[e-mail]    http://nic.cz/
  tel:[phone]       fax:[phone]
  -------------------------------------------