First-ever DNSSEC root key rollover
redhat.com
First-ever DNSSEC root key rollover
1–10 of 75 posts
Re: First-ever DNSSEC root key rollover
#2I have a DNSSEC signed zone, do I need to do anything? Like generate a new key using this new root key?
Re: First-ever DNSSEC root key rollover
#3I have a DNSSEC signed zone, do I need to do anything? Like generate a new key using this new root key?
No, this only impacts configuration on the validation side, not signing.
Re: First-ever DNSSEC root key rollover
#4I have a DNSSEC signed zone, do I need to do anything? Like generate a new key using this new root key?
No, because nobody really depends on DNSSEC, so nothing will break:
Re: First-ever DNSSEC root key rollover
#5I have a DNSSEC signed zone, do I need to do anything? Like generate a new key using this new root key?
Clients need to update their root keystore, but zones need no change.
Re: First-ever DNSSEC root key rollover
#6To check DNSSEC:
https://dnssec-name-and-shame.com
To check DANE (such as freebsd.org port 443):
Re: First-ever DNSSEC root key rollover
#7To check DNSSEC: https://dnssec-name-and-shame.com To check DANE (such as freebsd.org port 443): https://www.huque.com/bin/danecheck
The dnssec-name-and-shame site makes an incredibly loud noise if the site you type in happens to not be compliant or whatever. Be sure to remove your headphones before clicking any links in the above comment.
Re: First-ever DNSSEC root key rollover
#8What is the purpose of rolling over the key, if the new key is simply signed by the old one? Meaning it has exactly as much security as the old key did.
I can understand it if the new key was a different algorithm, or key-length or something. But what is the purpose in simply picking a new key?
Re: First-ever DNSSEC root key rollover
#9What is the purpose of rolling over the key, if the new key is simply signed by the old one? Meaning it has exactly as much security as the old key did. I can understand it if the new key was a different algorithm, or key-length or something. But what is the purpose in simply picking a new key?
The old one will presumably eventually be expired. That means someone who compromised the old one can't hang onto their access indefinitely.
Re: First-ever DNSSEC root key rollover
#10What is the purpose of rolling over the key, if the new key is simply signed by the old one? Meaning it has exactly as much security as the old key did. I can understand it if the new key was a different algorithm, or key-length or something. But what is the purpose in simply picking a new key?
If the old key has been unknowingly compromised, it is now replaced. The new key is not "simply" signed by the old one. You have to announce it for 30 days, making it harder to pull of a surreptitious switch.