bugZoneCheck - Bugs: bug #38427, DNSSEC algorithm rollover

 
 

bug #38427: DNSSEC algorithm rollover

Submitter:  Benjamin Zwittnig <bzwitt>
Submitted:  Wed 27 Feb 2013 02:12:26 PM UTC
   
 
Category:  * tests Severity:  High
Priority:  5 - Normal Item Group:  * Feature request
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 27 Feb 2013 04:17:02 PM UTC, comment #1: 

I am not convinced that Zonecheck is wrong. The case you describe is common in some pre-publication schemes (for instance when people publish DS without a matching DNSKEY in the zone) and it seems to me that the resolver should validate nevertheless, as long as one DS points to a valid DNSKEY. Did you discuss the problem with the Unbound people?

Stephane Bortzmeyer <bortzmeyer>
Group administrator
Wed 27 Feb 2013 02:12:26 PM UTC, original submission:  

Yesterday we had an issue with a domain bnl.gov. They are possibly trying to do an algorithm rollover (from algorithm 5 to algorithm 7). The domain is broken since it has DS/KSK records (both algorithms 5 and 7) but it does not have any algorithm 7 ZSK and also no RRSIGs done with algorithm 7 (all RRSIGs are done with ZSK with algorithm 5). Zonecheck does not find any errors in the domain although some validating resolvers (unbound) cannot validate the answers.

Best regards,

Benjamin Zwittnig,
.si

Benjamin Zwittnig <bzwitt>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bortzmeyer (Posted a comment)
  • -email is unavailable- added by bzwitt (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code