<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
--></style><title>Re: [dns-operations] signing a zone with NSEC3
records.</title></head><body>
<div>(Resending because the quote level indicators went
missing.)</div>
<div><br></div>
<div>At 12:07 -0700 9/10/09, Ravi Kondamuru wrote:</div>
<div><br></div>
<div>># 5. sign the zone with both the keys and opt for NSEC3 by
using option -3:</div>
<div>>does not generate a signed domain.</div>
<div>># indicates error: NSEC3 generation requested with NSEC only
DNSKEY</div>
<div>>fbsd63# dnssec-signzone -o <a
href="http://testnsecnsec3.org">testnsecnsec3.org</a></div>
<div>>-k Ktestnsecnsec3.org.+005+64081.private</div>
<div>>-k Ktestnsecnsec3.org.+007+19293.private -3</div>
<div>>bb6945e66c82b958763f5fb69f745a78 testnsecnsec3.org.db</div>
<div>>Ktestnsecnsec3.org.+005+64917.private</div>
<div>>Ktestnsecnsec3.org.+007+56312.private</div>
<div>></div>
<div>>dnssec-signzone: NSEC3 generation requested with NSEC only
DNSKEY</div>
<div><br></div>
<div>The problem is you can't NSEC3 with a NSEC-only key, but you can
NSEC with an NSEC3-capable key.</div>
<div><br>
I made the same mistake when I tried this the first time.</div>
<div><br></div>
<div>>Am I doing something wrong in step 5 or is it not possible to
do (5)?</div>
<div>>With step 4, I got a signed domain inline with what you have
attached in</div>
<div>>your email.</div>
<div><br></div>
<div>So - alg 5 and/or 7 can be in a NSEC zone</div>
<div>Only alg 7 can be in a NSEC3 zone</div>
<div><br></div>
<div>The reason is that if a validator only knows alg 5, it probably
doesn't understand NSEC3 so it would have issues.</div>
<div><br></div>
<div>If a validator knows alg 7, it knows NSEC (from the old days) and
NSEC3 (the new thing).</div>
<x-sigsep><pre>--
</pre></x-sigsep>
<div
>-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=<span
></span>-=-=-=-</div>
<div>Edward
Lewis <span
></span> <br>
NeuStar <span
></span> You can
leave a voice message at +1-571-434-5468</div>
<div><br></div>
<div>As with IPv6, the problem with the deployment of frictionless
surfaces is</div>
<div>that they're not getting traction.</div>
</body>
</html>