bugZoneCheck - Bugs: bug #38427, DNSSEC algorithm rollover

 
 

bug #38427: DNSSEC algorithm rollover

Submitted by:  Benjamin Zwittnig <bzwitt>
Submitted on:  Wed 27 Feb 2013 02:12:26 PM UTC  
 
Category: testsSeverity: High
Priority: 5 - NormalItem Group: Feature request
Status: NonePrivacy: Public
Assigned to: NoneOpen/Closed: Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 27 Feb 2013 04:17:02 PM UTC, comment #1:

I am not convinced that Zonecheck is wrong. The case you describe is common in some pre-publication schemes (for instance when people publish DS without a matching DNSKEY in the zone) and it seems to me that the resolver should validate nevertheless, as long as one DS points to a valid DNSKEY. Did you discuss the problem with the Unbound people?

Stephane Bortzmeyer <bortzmeyer>
Project Administrator
Wed 27 Feb 2013 02:12:26 PM UTC, original submission:

Yesterday we had an issue with a domain bnl.gov. They are possibly trying to do an algorithm rollover (from algorithm 5 to algorithm 7). The domain is broken since it has DS/KSK records (both algorithms 5 and 7) but it does not have any algorithm 7 ZSK and also no RRSIGs done with algorithm 7 (all RRSIGs are done with ZSK with algorithm 5). Zonecheck does not find any errors in the domain although some validating resolvers (unbound) cannot validate the answers.

Best regards,

Benjamin Zwittnig,
.si

Benjamin Zwittnig <bzwitt>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bortzmeyer (Posted a comment)
  • -unavailable- added by bzwitt (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    No Changes Have Been Made to This Item

    Back to the top


    Powered by Savane 3.1-cleanup1