Subject: Re: [dnsext] DNSKEY signatures - dnssec-bis updates

From: Samuel Weiler <[email-masked]>
Date: Mon, 8 Mar 2010 04:14:32 -0500 (EST)

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

As further discussion in this thread pointed out, 4034 doesn't seem to 
say this.  I haven't made any changes to dnssec-bis-updates as a 
result.

(It does say "... signed by each algorithm appearing in the DS RRset 
..", which is something different.)

-- Sam

On Thu, 12 Nov 2009, W.C.A. Wijngaards wrote:

> Hi,
>
> In RFC4034 it says that the DNSKEY RRset has to be signed with all keys in 
> it.  However current (best practice?) is that this is not required, but 
> optional.  It MAY be signed with all keys, but signing with less produces a 
> smaller DNSKEY RRset which helps with other (PMTU) things.
>
> I propose to add text to dnssec-bis updates to cover this:
>
>  The DNSKEY RRset at the zone apex MAY be signed by all keys.  It MUST be 
> signed with a key for which a DS exists at a parent, or which is the current 
> trust anchor, otherwise a validator cannot form a chain of trust to the zone. 
> It MAY be signed with keys that are not actually in the keyset (this is for 
> corner cases with old trust anchors).  If multiple algorithms are in use, it 
> MUST be signed with them (this rule does not change from RFC4034).
>
> (You may want to add text to explain that a DLV is like a DS for this, or 
> leave that as (like, totally) obvious to the reader).  :-)
>
> Best regards,
>   Wouter
>