Subject: [dnsext] DNSKEY signatures - dnssec-bis updates

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Thu, 12 Nov 2009 10:04:04 +0100

Hi,

In RFC4034 it says that the DNSKEY RRset has to be signed with all keys 
in it.  However current (best practice?) is that this is not required, 
but optional.  It MAY be signed with all keys, but signing with less 
produces a smaller DNSKEY RRset which helps with other (PMTU) things.

I propose to add text to dnssec-bis updates to cover this:

   The DNSKEY RRset at the zone apex MAY be signed by all keys.  It MUST 
be signed with a key for which a DS exists at a parent, or which is the 
current trust anchor, otherwise a validator cannot form a chain of trust 
to the zone.  It MAY be signed with keys that are not actually in the 
keyset (this is for corner cases with old trust anchors).  If multiple 
algorithms are in use, it MUST be signed with them (this rule does not 
change from RFC4034).

(You may want to add text to explain that a DLV is like a DS for this, 
or leave that as (like, totally) obvious to the reader).  :-)

Best regards,
    Wouter

---

From: Mark Andrews <[email-masked]>
Date: Fri, 13 Nov 2009 02:06:17 +1100

> algorithms are in use, it MUST be signed with them (this rule does not 

This text is too restrictive.  Assuming we are not in a key rollover
then the requirement is that for each DNSKEY algorithm and DS hash
algorithm pair in the DS RRset in the parent there MUST be one
DNSKEY which is identified by a DS which signs the DNSKEY RRset.
 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: "Roy Arends" <[email-masked]>
Date: Fri, 13 Nov 2009 06:49:40 +0900

Wouter Wijngaards wrote on 11/12/2009 06:04:04 PM:

> in it. 

Where?

Roy

---

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Fri, 13 Nov 2009 08:45:55 +0100

>> In RFC4034 it says that the DNSKEY RRset has to be signed with all keys

I thought it did, but I cannot find text: the example in the appendix
has an unnecessary ZSK-signature over the DNSKEY RRset.

Perhaps this is because of language in rfc4641 that speaks about ZSK
signing all RRsets in the zone, and maybe in diagrams in said RFC.

Best regards,
   Wouter