[dns-operations] signing a zone with NSEC3 records.

[Edward Lewis]

At 12:07 -0700 9/10/09, Ravi Kondamuru wrote:

# 5. sign the zone with both the keys and opt for NSEC3 by using 
option -3: does not generate a signed domain.
# indicates error: NSEC3 generation requested with NSEC only DNSKEY
fbsd63# dnssec-signzone -o 
<http://testnsecnsec3.org>testnsecnsec3.org -k 
Ktestnsecnsec3.org.+005+64081.private -k 
Ktestnsecnsec3.org.+007+19293.private -3 
bb6945e66c82b958763f5fb69f745a78 testnsecnsec3.org.db 
Ktestnsecnsec3.org.+005+64917.private 
Ktestnsecnsec3.org.+007+56312.private

dnssec-signzone: NSEC3 generation requested with NSEC only DNSKEY


The problem is you can't NSEC3 with a NSEC-only key, but you can NSEC 
with an NSEC3-capable key.

I made the same mistake when I tried this the first time.

Am I doing something wrong in step 5 or is it not possible to do (5)?
With step 4, I got a signed domain inline with what you have attached 
in your email.

So - alg 5 and/or 7 can be in a NSEC zone
Only alg 7 can be in a NSEC3 zone

The reason is that if a validator only knows alg 5, it probably 
doesn't understand NSEC3 so it would have issues.

If a validator knows alg 7, it knows NSEC (from the old days) and 
NSEC3 (the new thing).
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at +1-571-434-5468

As with IPv6, the problem with the deployment of frictionless surfaces is
that they're not getting traction.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20090910/60a11c52/attachment.html>