[Docs] [txt|pdf] [Tracker] [Email] [Nits]

Versions: 00

Individual                                                    O. Kolkman
Internet-Draft                                                  RIPE NCC
Expires: February 19, 2004                                     R. Gieben
                                                              NLnet Labs
                                                         August 21, 2003


                         DNSSEC key operations
           draft-kolkman-dnssec-operational-practices-00.txt

Status of this Memo

   This document is an Internet-Draft and is in full conformance with
   all provisions of Section 10 of RFC2026.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as
   Internet-Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at http://
   www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on February 19, 2004.

Copyright Notice

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

Abstract

   This Internet-Draft is intended as a place holder for considerations
   and operational practices for DNSSEC key-management.  It is intended
   to be 'long-lived' and result in documentation of best(?) current
   practices.









Kolkman & Gieben       Expires February 19, 2004                [Page 1]

Internet-Draft           DNSSEC key operations               August 2003


Table of Contents

   1.    Introduction . . . . . . . . . . . . . . . . . . . . . . . .  3
   2.    Time in DNSSEC . . . . . . . . . . . . . . . . . . . . . . .  3
   2.1   Time definitions . . . . . . . . . . . . . . . . . . . . . .  3
   2.2   Time considerations  . . . . . . . . . . . . . . . . . . . .  4
   3.    Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . .  6
   3.1   Using Key-Signing and Zone-Signing Keys. . . . . . . . . . .  6
   3.1.1 Motivations for the KSK and ZSK functions  . . . . . . . . .  6
   3.2   Key security considerations  . . . . . . . . . . . . . . . .  6
   3.3   Key rollovers  . . . . . . . . . . . . . . . . . . . . . . .  7
   3.3.1 Zone-signing key rollovers . . . . . . . . . . . . . . . . .  7
   3.3.2 Key-signing key rollovers  . . . . . . . . . . . . . . . . . 10
   4.    Planning for emergency key rollover. . . . . . . . . . . . . 11
   4.1   KSK compromise . . . . . . . . . . . . . . . . . . . . . . . 12
   4.2   ZSK compromise . . . . . . . . . . . . . . . . . . . . . . . 12
   4.3   Compromises of keys configured at the resolver level . . . . 12
   5.    Parental policies. . . . . . . . . . . . . . . . . . . . . . 13
   6.    Initial key exchanges and parental policies
         considerations.  . . . . . . . . . . . . . . . . . . . . . . 13
   6.1   Storing keys so hashes can be regenerated  . . . . . . . . . 13
   6.2   Self signed keys during upload or not? . . . . . . . . . . . 13
   6.3   Security lameness checks.  . . . . . . . . . . . . . . . . . 13
   6.4   SIG DS validity period.  . . . . . . . . . . . . . . . . . . 13
   7.    Resolver key configuration.  . . . . . . . . . . . . . . . . 13
   8.    Security considerations  . . . . . . . . . . . . . . . . . . 13
   9.    Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . 13
         Normative References . . . . . . . . . . . . . . . . . . . . 14
         Informative References . . . . . . . . . . . . . . . . . . . 14
         Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 15
   A.    Terminology  . . . . . . . . . . . . . . . . . . . . . . . . 15
   B.    Zone-signing key rollover howto  . . . . . . . . . . . . . . 16
   C.    Typographic conventions  . . . . . . . . . . . . . . . . . . 16
         Intellectual Property and Copyright Statements . . . . . . . 19

















Kolkman & Gieben       Expires February 19, 2004                [Page 2]

Internet-Draft           DNSSEC key operations               August 2003


1. Introduction

   During workshops and early operational deployment test, operators and
   system administrators have gained knowledge about operating DNSSEC
   aware DNS services.  This document intends to document the current
   practices and the background on why practices are as they are.

   The structure of the document is roughly as follows.  We start with
   discussing some of the consideration with respect to timing
   parameters of DNS in relation to DNSSEC in Section 2.  Aspects of Key
   management such as key rollover schemes are described Section 3.
   Emergency rollover considerations are addressed in Section 4.  The
   Typographic conventions used in this document are explained in
   Appendix C

   Since this is a document with operational suggestions and there is no
   protocol specifications the RFC2119 [5] language does not apply.

2. Time in DNSSEC

   In pre-DNSSEC DNS all times were relative.  The SOA, refresh, retry
   and expiration timers are counters that are being used to determine
   the time since the most recent time a slave server synced (or tried
   to sync) with a master server.  The TTL value and the SOA minimum TTL
   parameter [6] are used to to determine how long a forwarder should
   cache data after it has been fetched from an authoritative server.
   DNSSEC introduces an absolute time in the DNS.  Signatures in DNSSEC
   have an expiration date after which the signature is invalid and the
   signed data is to be considered bad.

2.1 Time definitions

   In this section we will be using a number of time related terms.
   Within the context of this document the following definitions apply:

   o  "Signature validity period"

         The period that a signature is valid.  It starts at the time
         specified in the signature inception field of the SIG RR and
         ends at the time specified in the expiration field of the SIG
         RR.

   o  "Signature refresh period"

         Time after which a signature made with a key is replaced with a
         new signature made with the same key.  This replacement takes
         place in the master zone file.  If a signature is created on
         time T0 and a new signature is made on time T1, the signature



Kolkman & Gieben       Expires February 19, 2004                [Page 3]

Internet-Draft           DNSSEC key operations               August 2003


         refresh time is T1 - T0.  If all signatures are refreshed at
         zone signing than the signature refresh period is equal to the
         period between two consecutive zone signing operations.

   o  "Key usage period"

         The period between when data signed with this key first appears
         in the DNS and the time the authentication chain to this key is
         broken i.e.  the signature over the parental DS RR has expired
         and this public key is not hard-configured as trusted entry
         point into verifying resolvers.  The "Key usage period" is
         essentially the window of opportunity for cryptanalists to
         attack a key.

   o  "Key publication period"

         The period for which the public part of the key is published in
         the DNS.  The public part of the key can be published in the
         DNS while it has not yet been used to sign data As soon as a
         public key is published a brute force attack can be attempted
         to recover the private key.  Publishing the public key in
         advance (and not signing any data with it) does not guard
         against this attack.

   o  "Maximum/Minimum Zone TTL"

         The maximum or minimum value of all the TTLs in your zone.


2.2 Time considerations

   Because of the expiration of signatures one should consider the
   following.

   o  The Maximum zone TTL  of your zone data should be a fraction of
      your signature validity period.

         If the the TTL would be of similar order as the signature
         validity period then all RRsets fetched during the validity
         period would be cached until the signature expiration time.
         The result would be that query behavior may become bursty.

         We suggest the TTL on all the RRs in your zone to be at least
         an order of magnitude smaller than your signature validity
         period.

   o  The Minimum zone TTL should be long enough to fetch and verify all
      the RRs in the authentication chain.



Kolkman & Gieben       Expires February 19, 2004                [Page 4]

Internet-Draft           DNSSEC key operations               August 2003


            1.  During validation, some data may expire before
            validation is complete.  The validator should be able to
            keep all the data, until validation is complete.  This
            applies to all data in the chain of trust: DSs, DNSKEYs,
            RRSIGs, and the final answers i.e.  the RR that is returned
            for the initial query.

            2.  Frequent re-verification causes load on recursive
            nameserver.  Data at delegation points, DS, DNSKEY and
            RRSIGs over that those should benefit from caching.  The TTL
            on those should be relatively long.

         We have seen events where data needed for verification of an
         authentication chain had expired from caches.

         We suggest the TTL on DNSKEY and DSs to be at least of the
         order 10 minutes to an hour and all the other RRs in your zone
         to be at least 30 seconds.  [Editors note: These are initial
         values]

   o  The signature refresh period should at least be one maximum TTL
      smaller than the signature validity period.

         If a zone is resigned shortly before the end of the signature
         validity period then this may cause simultaneous expire of data
         from caches which  leads to bursty query behavior and increase
         the load on authoritative servers.

   o  Slave servers will need to be able to fetch newly signed zones
      well before the data expires from your zone.

         If a properly implemented slave server is not able to contact a
         master server for an extended period it will at some point
         expire and not hand out any data.  If the server serves a
         DNSSEC zone than it may well happen that the signatures expire
         well before the SOA expiration timer counted down to zero.  It
         is not possible to fully prevent this from happening by
         tweaking the SOA parameters.  But the effects can be minimized
         if the SOA expiration time is a fraction of the signature
         validity period.

         When a zone cannot be updated while signatures in that zone
         have expired non-secure resolvers will continue to be able to
         resolve the data served by the particular slave servers.  Only
         security aware resolvers that receive data with expired
         signatures will experience problems.





Kolkman & Gieben       Expires February 19, 2004                [Page 5]

Internet-Draft           DNSSEC key operations               August 2003


         We suggest the SOA expiration timer being approximately one
         third or one forth of the signature validity period.

         We also suggest that operators of nameservers with slave zones
         develop watchdogs to be able to spot these upcoming signature
         expirations in slave zones, so that appropriate action can be
         taken.

   o  [Editor's Note: Need examples here]


3. Keys

3.1 Using Key-Signing and Zone-Signing Keys.

3.1.1 Motivations for the KSK and ZSK functions

   Although all data in a zone can simply be signed by one single key
   using two keys has its advantages.  Delegation Signer [7] introduced
   the concept of key-signing and zone-signing keys while
   Key-signing-flag [4] introduced the concept of a key with the Secure
   Entry Point flag set; a key that is the first key from the zone when
   following an authentication chain.  When using a key-signing key with
   the SEP flag set, where the parent has a DS RR pointing to that
   DNSKEY, and when using  zone-signing keys without the SEP flag set
   one can use the following operational procedures.

   The zone-signing key can be used to sign all the data in a zone on a
   regular basis.  When a zone-signing key is to be rolled over no
   interactions with third parties are needed.  This allows for
   relatively short "Signature Validity Periods" (order of days).

   The key-signing key (with the SEP flag set) is only to be used to
   sign the Key RR set from the zone apex.  If a key-signing key is to
   be rolled over, there will be interactions with parties other than
   the zone maintainer such as the registry of the parent zone or
   administrators of verifying resolvers that have the particular key
   configured as trusted entry points.  Hence, the "Key Usage Time" of
   these keys can and should be made much longer.  Although, given a
   long enough key, the "Key Usage Time" can be on the order of years we
   suggest to plan for a "Key Usage Time" of the order of a few months
   so that a key rollover remains an operational routine.

3.2 Key security considerations

   In RFC2541 [2] a number of considerations with respect to the
   security of keys are described.  That document deals in detail with
   generation, lifetime, size and storage of private keys.



Kolkman & Gieben       Expires February 19, 2004                [Page 6]

Internet-Draft           DNSSEC key operations               August 2003


   In Section 3 of RFC2541 [2], Eastlake does make some hard number
   suggestions: 13 months for long-lived keys and 36 days for
   transaction keys but suggestions for key lengths are not made.

   [Editors note: We consider keylength suggestions outside of scope for
   this document.  Wess Griffin suggested: Hilarie Orman wrote a draft
   (orman-public-key-lengths-05, it has expired) that had some good
   discussion of public key lengths and matching them to symmetric
   cipher key length strengths.  Also there's eastlake-randomness2-04
   that will obsolete RFC1750 that has an appendix on symmetric key
   lengths.  Not really applicable here, but a good discussion of how to
   choose key lengths.]

3.3 Key rollovers

   Key rollovers are a fact of live when using DNSSEC.  A DNSSEC key
   cannot be used eternally (see RFC2541 [2] and Section 3.2 ).  Zone
   maintainers who are in the process of rolling their keys have to take
   into account that data they have published in previous versions of
   their zone still lives in caches.  When deploying DNSSEC this becomes
   an important consideration; ignoring data that may be in caches may
   lead to loss of service for clients

   The most pressing example of this is when zone material which is
   signed with an old key is being validated by a resolver who does not
   have the old zone key cached.  If the old key is no longer present in
   the current zone, this validation fails, marking the data bad.
   Alternatively, an attempt could be made to validate data which is
   signed with a new key against a old key that lives a a local cache,
   also resulting in data being marked bad.

   To appreciate the situation one could think of a number of
   authoritative servers that may not be instantaneously running the
   same version of a zone and a security aware non-recursive resolver
   that sits behind security aware caching forwarders.

   [Editors note: This needs more verbose explanation, nobody will
   appreciate the situation just yet.  Help with text and examples will
   be appreciated]

3.3.1 Zone-signing key rollovers

   For zone-signing key rollovers there are two ways to make sure that
   during the rollover the data still in caches can be verified with the
   new keysets or the newly generated signatures can be verified with
   the keys still in caches.  One schema uses double signatures, it is
   described in Section 3.3.1.1, the other uses key pre-publication
   (Section 3.3.1.2).  The pros and cons and recomendations are



Kolkman & Gieben       Expires February 19, 2004                [Page 7]

Internet-Draft           DNSSEC key operations               August 2003


   described in Section 3.3.1.3.

3.3.1.1 A double signature zone-signing key rollover

   This section shows how to perform a ZSK key using the double zone
   data signature scheme.

   During the rollover stage the new version of the zone file will need
   to propagate to all authoritative servers and the data that existed
   in distant caches will need to expire, this will last at least the
   maximum Zone TTL .

       normal              roll            after

       SOA0                SOA1            SOA2
       SIG10(SOA0)         SIG10(SOA1)     SIG11(SOA2)
                           SIG11(SOA1)

       KEY1                KEY1            KEY1
       KEY10               KEY10           KEY11
                           KEY11
       SIG1 (KEY)          SIG1 (KEY)      SIG1 (KEY)
       SIG10(KEY)          SIG10(KEY)      SIG11(KEY)
                           SIG11(KEY)

   normal: Version 0 of the zone: KEY1 is a key-signing key.  Key 10 is
      used to sign all the data of the zone, it is the zone-signing key.

   roll: At the rollover stage (SOA serial 1) key 11 is introduced into
      the keyset and all the data in the zone is signed with KEY 10 and
      KEY 11.  The rollover period will need to exist until all data
      from version 0 of the zone has expired from remote caches.  This
      will take at least the maximum value of all the TTLs in the
      version 0 of the zone.

   after: KEY10 is removed from the zone.  All the signatures from KEY10
      are removed from the zone.  The keyset, now only containing KEY11)
      is resigned with the KEY1.

   At every instance the data from the previous version of the zone can
   be verified with the key from the current version.  Besides, the data
   from the current version can be verified with the data from the
   previous version of the zone.  The duration of the rollover phase and
   the period between rollovers should be at least the "Maximum Zone
   TTL".

   To be on the safe side one could make sure that the rollover phase
   lasts until the signature expiration time of the data in version 0 of



Kolkman & Gieben       Expires February 19, 2004                [Page 8]

Internet-Draft           DNSSEC key operations               August 2003


   the zone.  But this date could be considerable longer than the TTL,
   making the rollover a lengthly procedure.

   Note that in this example we assumed that the zone did not get
   modified during the rollover.  New data can be introduced in the zone
   as long as it is signed with both keys.

3.3.1.2 Pre-publish keyset rollover

   This section shows how to perform a ZSK key without the need to sign
   all the data in ones zone twice.  We recommend this method because it
   has certain advantages in the case of key compromises.  A small
   "HOWTO" for this kind of rollover can be found in Appendix B.

       normal          pre-roll       roll         after

       SOA0            SOA1           SOA2         SOA3
       SIG10(SOA0)     SIG10(SOA1)    SIG11(SOA2)  SIG11(SOA3)

       KEY1            KEY1           KEY1         KEY1
       KEY10           KEY10          KEY10        KEY11
                       KEY11          KEY11
       SIG1 (KEY)      SIG1 (KEY)     SIG1(KEY)    SIG1 (KEY)
       SIG10(KEY)      SIG10(KEY)     SIG11(KEY)   SIG11(KEY)


   normal: Version 0 of the zone: KEY1 is a key-signing key.  Key 10 is
      used to sign all the data of the zone, its the zone-signing key.

   pre-roll: Key 11 is introduced in the keyset.  Note that no
      signatures are generated with this key yet, but this will not
      prevent brute force attacks on the public key.  The minimum
      duration of this pre-roll phase is the time it takes for the data
      to propagate to the authoritative servers plus TTL value on the
      keyset.  [FIXME: 3 times the TTL then]

   roll:

      At the rollover stage (SOA serial 1) KEY 11 is used to sign the
      data in the zone (exclusively i.e.  all the signatures from KEY10
      are removed from the zone.).  KEY 10 remains published in the
      keyset.  This way data that was loaded into caches from version 1
      of the zone can still be verified with key sets fetched from
      version 2 of the zone.

      The minimum time that the keyset that includes KEY 10 is to be
      published is the time that it takes for zone data from the
      previous version of the zone to expire from old caches i.e.  the



Kolkman & Gieben       Expires February 19, 2004                [Page 9]

Internet-Draft           DNSSEC key operations               August 2003


      time it takes for this zone to propagate to all authoritative
      servers plus the maximum TTL value of any of the data in the
      previous version of the zone.  [FIXME: 3 times the TTL then?]

   after: KEY10 is removed from the zone.  The keyset, now only
      containing KEY11 is resigned with the KEY1.

   The above scheme can be simplified a bit by always publishing the
   "future" key immediately after the rollover.  The scheme would look
   like this (we show 2 rollovers):


       normal       roll         after       2nd roll    2nd after

       SOA0         SOA2         SOA3        SOA4        SOA5
       SIG10(SOA0)  SIG11(SOA2)  SIG11(SOA3) SIG12(SOA4) SIG12(SOA5)

       KEY1         KEY1         KEY1        KEY1        KEY1
       KEY10        KEY10        KEY11       KEY11       KEY12
       KEY11        KEY11        KEY12       KEY12       KEY13
       SIG1 (KEY)   SIG1 (KEY)   SIG1(KEY)   SIG1(KEY)   SIG1(KEY)
       SIG10(KEY)   SIG11(KEY)   SIG11(KEY)  SIG12(KEY)  SIG12(KEY)


   Note that the key introduced after the rollover is not used for
   production yet; the private key can thus be stored in a physically
   secure space and does not need to be 'fetched' every time a zone
   needs to be signed.

   This scheme has the benefit that the key that is intended for future
   use, can immediately be used during an emergency rollover under the
   assumption that it was stored physically secure.

3.3.1.3 Pros and cons of the schemes

   A double signature rollover: The drawback of this signing scheme is
      that during the rollover the amount of signatures in your zone
      doubles, which may be prohibitive if you have very big zones.

   Prepublish-keyset rollover.  This rollover does not involve signing
      the zone data twice, but before the actual rollover the new key is
      published in the keyset and thus available for cryptanalysis
      attacks.


3.3.2 Key-signing key rollovers

   For the rollover of a key-signing key the same considerations as for



Kolkman & Gieben       Expires February 19, 2004               [Page 10]

Internet-Draft           DNSSEC key operations               August 2003


   the rollover of a zone-signing key apply.  However we can use a
   single double signature scheme to guarantee that old data (only the
   apex keyset) in caches can be verified with a new keyset and vice
   verse.


       normal       roll         after

       SOA0         SOA2         SOA3
       SIG10(SOA0)  SIG11(SOA2)  SIG11(SOA3)

       KEY1         KEY1         KEY2
                    KEY2
       KEY10        KEY10        KEY11
       KEY11        KEY11        KEY12
       SIG1 (KEY)   SIG1 (KEY)   SIG2(KEY)
                    SIG2 (KEY)
       SIG10(KEY)   SIG11(KEY)   SIG11(KEY)


4. Planning for emergency key rollover.

   This section deals with what one has to consider in preparation of a
   reaction to a possible key compromise.  Our advice is to have a
   documented procedure ready for when a key compromise would ever
   happen.

   [Editors note: We are much in favor of a rollover tactic that keeps
   the authentication chain intact as long as possible.  This has as a
   result that one has to take all the regular rollover properties into
   account.]

   When the private material of one of your keys is compromised it can
   be used by 'blackhats' for as long as a valid authentication chain
   exists.  A authentication chain remains intact for:

      as long as a signature over the compromised key made by another
      key in the authentication chain is valid,

      as long as a parental DS RR (and signature) points to the
      compromised key,

      as long as the key is anchored in a resolver and is used as a
      starting point for validation.  (This is hardest to update.)

   While an authentication chain to your compromised key exists your
   name-space is vulnerable to abuse by the "black-hat".  Zone operators
   have to make a trade off if the abuse of the compromised key is worse



Kolkman & Gieben       Expires February 19, 2004               [Page 11]

Internet-Draft           DNSSEC key operations               August 2003


   than having data in caches that cannot be validated.  If the zone
   operator chooses to break the authentication chain to the compromised
   key, data in caches signed with this key can not be validated.  On
   the other hand if the zone administrator chooses to take the path of
   a regular roll-over the "black-hat" can spoof data so that it appears
   to be valid, note that this kind of attack will usually be localized
   in the Internet topology.


4.1 KSK compromise

   When the KSK has been compromised the parent must be notified as soon
   as possible and in a secure means.  The keyset of the zone SHOULD
   also be resigned as soon as possible.  Care must be taken to not
   break the authentication chain.  The local zone can only be resigned
   with the new KSK when the parent's zone has been updated with the new
   KSK.  Before this update takes place it would be best to drop the
   security status of a zone all together: the parent removes the DS of
   the child at the next zone update.  After that the child can be made
   secure again.  An additional danger of a key compromise is that the
   compromised key can be used to facilitate a legitemate key/ds and/or
   nameserver rollover at the parent.  When that happens the domain can
   be in dispute.  An out of band and secure notify mechanism to contact
   a parent is really needed in this case.

4.2 ZSK compromise

   Though not as bad as a KSK compromise mainly because there is no
   parental interaction required.  The zone must still be resigned with
   a new ZSK as soon as possible.  As this is a local operation and
   requires no communication between the parent and child this can be
   achieved quickly.  One has to take into account though that just as
   with a normal rollover immediate disappearance from the old
   compromised key may lead to verification problems.  The
   pre-publication scheme as discussed above minimizes that problem.

4.3 Compromises of keys configured at the resolver level

   A key can also be pre-configured in resolvers.  If DNSSEC is rolled
   out as planned the root key should be pre-configured in every secure
   aware resolver on the planet.  [Editors Note: add more about
   authentication of a newly received resolver key]

   If that key is compromised all the resolvers should be notified of
   this fact.  Zone administrators may consider setting up a mailing
   list to communicate the fact that a KSK is about to be rolled over.
   This communication will of course need to be secured e.g.  by using
   digital signatures.



Kolkman & Gieben       Expires February 19, 2004               [Page 12]

Internet-Draft           DNSSEC key operations               August 2003


   Key must be removed as soon as possible.  Non updated resolver will
   have a problem.  [Editors Note: this should be extended a bit more]

5. Parental policies.

6. Initial key exchanges and parental policies considerations.

6.1 Storing keys so hashes can be regenerated

6.2 Self signed keys during upload or not?

6.3 Security lameness checks.

6.4 SIG DS validity period.

   Since the DS can be replayed as long as it has a valid signature a
   short signature validity period over the DS minimizes the time a
   child is vulnerable in the case of a compromise of the child's KSK.
   A signature validity period that is too short introduces the
   possibility that a zone is marked BAD in case of a configuration
   error in the signer; there may not be enough time to fix the problems
   before signatures expire.  Something as mundane as weekends show the
   need for a DS signature lifetimes longer than 2 days.  We recommend
   the minimum for a DS signature validity period to be about 2 days.

   The maximum signature lifetime of the DS record depends on how long
   child zones are willing to be vulnerable after a key compromise.  We
   consider a signature validity period of the order of a week a good
   compromise between the operational constraints of the parent and
   minimizing damage for the child.

7. Resolver key configuration.

   Zone keys may be hard configured in resolver configurations.  In case
   of a compromise of a SEP key these "distant" resolvers will need to
   be informed of a compromise and will need to take appropriate action.
   A special purpose maillist on which such a compromise can be
   announced (securely) and a set of procedures for securely publishing
   the new SEP key should be considered.

8. Security considerations

   DNSSEC adds data integrity to the DNS.  This document tries to assess
   considerations to operate a stable and secure DNSSEC service.

9. Acknowledgments

   We, the folk mentioned as authors, only acted as editors.  Most of



Kolkman & Gieben       Expires February 19, 2004               [Page 13]

Internet-Draft           DNSSEC key operations               August 2003


   the ideas in this draft where the result of collective efforts during
   workshops and discussions and try outs.

   At the risk of forgetting individuals who where the original
   contributors of the ideas we like to acknowledge people who where
   actively involved in the compilation of this document.  In
   alphabetical order: Olafur Gudmundsson, Wesley Griffin.

   Kolkman and Gieben take the blame for all mistakes.

Normative References

   [1]  Eastlake, D., "Domain Name System Security Extensions", RFC
        2535, March 1999.

   [2]  Eastlake, D., "DNS Security Operational Considerations", RFC
        2541, March 1999.

   [3]  Lewis, E., "DNS Security Extension Clarification on Zone
        Status", RFC 3090, March 2001.

   [4]  Lewis, E., Kolkman, O. and J. Schlyter, "KEY RR Key-Signing Key
        (KSK) Flag", draft-ietf-dnsext-keyrr-key-signing-flag-06 (work
        in progress), February 2003.

Informative References

   [5]  Bradner, S., "Key words for use in RFCs to Indicate Requirement
        Levels", BCP 14, RFC 2119, March 1997.

   [6]  Andrews, M., "Negative Caching of DNS Queries (DNS NCACHE)", RFC
        2308, March 1998.

   [7]  Gudmundsson, O., "Delegation Signer Resource Record",
        draft-ietf-dnsext-delegation-signer-13 (work in progress), March
        2003.

   [8]  Arends, R., "Protocol Modifications for the DNS Security
        Extensions", draft-ietf-dnsext-dnssec-protocol-01 (work in
        progress), March 2003.











Kolkman & Gieben       Expires February 19, 2004               [Page 14]

Internet-Draft           DNSSEC key operations               August 2003


Authors' Addresses

   Olaf M. Kolkman
   RIPE NCC
   Singel 256
   Amsterdam  1016 AB
   NL

   Phone: +31 20 535 4444
   EMail: olaf@ripe.net
   URI:   http://www.ripe.net/


   Miek Gieben
   NLnet Labs
   Kruislaan 419
   Amsterdam  1098 VA
   NL

   EMail: miek@nlnetlabs.nl
   URI:   http://www.nlnetlabs.nl

Appendix A. Terminology

   In this document there is some jargon used that is defined in other
   documents.  In most cases we have not copied the text from the
   documents defining the terms but give a more elaborate explanation of
   the meaning.  Note that these explanations should not be seen as
   authoritative.

   Private and Public Keys: DNSSEC secures the DNS through the use of
      public key cryptography.  Public key cryptography is based on the
      existence of 2 keys, a public key and a private key.  The public
      keys are published in the DNS by use of the KEY Resource Record
      (KEY RR).  Private keys are supposed to remain private i.e.
      should not be exposed to parties not-authorized to do the actual
      signing.

   Signer: The system that has access to the private key material and
      signs the Resource Record sets in a zone.  A signer may be
      configured to sign only parts of the zone e.g.  only those RRsets
      for which existing signatures are about to expire.

   KSK: A Key-Signing key (KSK) is a key that is used for exclusively
      signing the apex keyset.  The fact that a key is a KSK is only
      relevant to the signing tool.





Kolkman & Gieben       Expires February 19, 2004               [Page 15]

Internet-Draft           DNSSEC key operations               August 2003


   ZSK: A Zone signing key (ZSK) is a key that is used for signing all
      data in a zone.  The fact that a key is a ZSK is only relevant to
      the signing tool.

   Singing Zone Rollover: The term used for the event where an
      administrator joyfully rolls over the keys while producing melodic
      sound patterns.


Appendix B. Zone-signing key rollover howto

   Using the pre-published signature scheme and the most conservative
   method to assure oneself that data does not live in distant caches
   here follows the "HOWTO".  [WES: has some comments about this]

      STEP 0, the preparation: Create two keys and publish them both in
      your keyset.  Mark one of the keys as "active" and the other as
      "published".  Use the "active" key for signing your zone data.
      Store the private part of the "published" key, preferably
      off-line.

      STEP 1, determine expiration: At the beginning of the rollover:
      make a note of the highest expiration time of signatures in your
      zonefile created with the current key currently marked as
      "active".

      Wait until the expiration time marked in STEP 1

      STEP 2  Then start using the key that was marked as "published" to
      sign your data i.e.  mark it as "active".  Stop using the key that
      was marked as "active", mark it as "rolled".

      STEP 3: It is safe to engage in a new rollover (STEP 1) after at
      least "signature validity period".


Appendix C. Typographic conventions

   The following typographic conventions are used in this document:

   Key notation: A key is denoted by KEYx, where x is a number, x could
      be thought of as the key id.

   Signature notation: Signatures are denoted as SIGx(RRset), which
      means that RRset is signed with KEYx.






Kolkman & Gieben       Expires February 19, 2004               [Page 16]

Internet-Draft           DNSSEC key operations               August 2003


      Optionally the RRset can be written in full: SIG1(KEY1, KEY2).
      Which is the signature made with KEY1 over the keyset containing
      KEY1 and KEY2.

   Zone representation: Using the above notation we have simplify the
      representation of a signed ZONE by leaving out all unneeded
      details such as the names and by just representing all non zone
      apex data by "ZD" (Zone Data).

   SOA representation: Soa's are represented as SOA x, where x is the
      serial number.

   Using this notation the following zone :


   example.net.      600     IN SOA  ns.example.net. ernie.example.net. (
                                     10         ; serial
                                     450        ; refresh (7 minutes 30 seconds)
                                     600        ; retry (10 minutes)
                                     345600     ; expire (4 days)
                                     300        ; minimum (5 minutes)
                                     )
                     600     SIG     SOA 5 2 600 20130522213204 (
                                     20130422213204 14 example.net.
                                     cmL62SI6iAX46xGNQAdQ... )
                     600     NS      a.iana-servers.net.
                     600     NS      b.iana-servers.net.
                     600     SIG     NS 5 2 600 20130507213204 (
                                     20130407213204 14 example.net.
                                     SO5epiJei19AjXoUpFnQ ... )
                     3600    KEY     256 3 5 (
                                     EtRB9MP5/AvOuVO0I8XDxy0...
                                     ) ; key id = 14
                     3600    KEY     256 3 5 (
                                     gsPW/Yy19GzYIY+Gnr8HABU...
                                     ) ; key id = 15
                     3600    SIG     KEY 5 2 3600 20130522213204 (
                                     20130422213204 14 example.net.
                                     J4zCe8QX4tXVGjV4e1r9... )
                     3600    SIG     KEY 5 2 3600 20130522213204 (
                                     20130422213204 15 example.net.
                                     keVDCOpsSeDReyV6O... )
                     600     NXT     a.example.net. NS SOA TXT SIG KEY NXT
                     600     SIG     NXT 5 2 600 20130507213204 (
                                     20130407213204 14 example.net.
                                     obj3HEp1GjnmhRjX... )
   a.example.net.    600     IN TXT  "A label"
                     600     SIG     TXT 5 3 600 20130507213204 (



Kolkman & Gieben       Expires February 19, 2004               [Page 17]

Internet-Draft           DNSSEC key operations               August 2003


                                     20130407213204 14 example.net.
                                     IkDMlRdYLmXH7QJnuF3v... )
                     600     NXT     b.example.com. TXT SIG NXT
                     600     SIG     NXT 5 3 600 20130507213204 (
                                     20130407213204 14 example.net.
                                     bZMjoZ3bHjnEz0nIsPMM... )

                     ...


    is reduced to the following represenation:

       SOA10
       SIG14(SOA10)

       KEY14
       KEY15

       SIG14(KEY)
       SIG15(KEY)

    The rest of the zone data has the same signature as the SOA record.





























Kolkman & Gieben       Expires February 19, 2004               [Page 18]

Internet-Draft           DNSSEC key operations               August 2003


Intellectual Property Statement

   The IETF takes no position regarding the validity or scope of any
   intellectual property or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; neither does it represent that it
   has made any effort to identify any such rights.  Information on the
   IETF's procedures with respect to rights in standards-track and
   standards-related documentation can be found in BCP-11.  Copies of
   claims of rights made available for publication and any assurances of
   licenses to be made available, or the result of an attempt made to
   obtain a general license or permission for the use of such
   proprietary rights by implementors or users of this specification can
   be obtained from the IETF Secretariat.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights which may cover technology that may be required to practice
   this standard.  Please address the information to the IETF Executive
   Director.


Full Copyright Statement

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assignees.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION



Kolkman & Gieben       Expires February 19, 2004               [Page 19]

Internet-Draft           DNSSEC key operations               August 2003


   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.


Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.











































Kolkman & Gieben       Expires February 19, 2004               [Page 20]


Html markup produced by rfcmarkup 1.107, available from http://tools.ietf.org/tools/rfcmarkup/