Subject: Re: [DNSOP] [provreg] New Version Notification for draft-gieben-epp-keyrelay-00.txt

From: Patrik Fältström <[email-masked]>
Date: Fri, 25 Jan 2013 16:41:10 +0100

Discussion moved from provreg mailing list to dnsop mailing list.

The items discussed originally was draft-gieben-epp-keyrelay-00.txt but we now agree it is draft-koch-dnsop-dnssec-operator-change-04 we are discussing.

And, it is me thinking we complicate things too much.

I am asking questions like a devils advocate so that Antoin (and Peter) convince me things must be this complicated.

I made the claim that with double DS, both for old and new zone, we do not have to move the ZSK from old to new zone.

Antoin say I am wrong (which I absolutely do believe I can be), but I want to understand.

Antoin then wrote:

> The problem is that a cache may have cached the DNSKEY RRset from the
> old zone, and while that is still valid the NS RRset changes at the
> parent and the resolver recieves a new NS (or other) RRset from the
> new child zone with a new signature from the new ZSK that is not
> present in the cached DNSKEY RRset thus failing validation. This can
> only be solved if both DNSKEY RRsets contain both ZSK's from the new
> and old child zone. Same as you would do with a pre-publish ZSK rollover.

So, what we talk about is the case when different RRSets in the same zone are cached differently. Right?

> Transferring and keeping the old zone data on the new nameserver does
> not help, because at some point in time, at least the NS RRset needs
> to change and a new signature needs to be generated over it by a new
> ZSK that is not present in the DNSKEY RRset. A signature with the old
> ZSK over this new NS RRset cannot be generated because the old private
> ZSK is not available for signing by the new operator.

   Patrik

---

From: Antoin Verschuren <[email-masked]>
Date: Fri, 25 Jan 2013 17:00:47 +0100

Op 25-01-13 16:41, Patrik F￤ltstr￶m schreef:

> I made the claim that with double DS, both for old and new zone, we
> do not have to move the ZSK from old to new zone.

You make the same mistake again :-)
It has to move -from new-  -to old- zone to be pre-published.
- From old to new is not an issue. We can use DNS for that.

> same zone are cached differently. Right?

Yes, some records may be cached from the old zone, some from the new
zone, and neither zone can create signatures over those records with
the ZSK of the other, so a double signature is impossible.

- -- 
Antoin Verschuren

Technical Policy Advisor SIDN
Meander 501, PO Box 5022, 6802 EA Arnhem, The Netherlands

P: +31 26 3525500  M: +31 6 23368970
Mailto: [email-masked]
XMPP: [email-masked]
HTTP://www.sidn.nl/