Hello all!

A signed zone shall be moved to another DNS provider. Hence I want to add the public KSK of the gaining DNS provider as additional DNSKEY to the zone. My setup ist:

Bind1 as hidden primary --> Bind2 as bump-in-the-wire signer -> public facing secondaries

I tried to add the DNSKEY to the zone file of Bind1. Bind1 accepts the DNSKEY. But Bind2 only shows the DNSKEYs from the local key-directory, the original DNSKEY is removed/ignored.

I also tried to add the additonal DNSKEY into the key-directory of Bind2 (no .private file, only .key file). It did not worked too.

So, how is the correct process to add an additional DNSKEY (only the public key is known).

Thanks
Klaus

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Copy: bind-users@lists.isc.org (bind-users@lists.isc.org)

Klaus Darilion <klaus.darilion@nic.at> wrote:

A signed zone shall be moved to another DNS provider. Hence I want to
add the public KSK of the gaining DNS provider as additional DNSKEY to
the zone.

I guess you might already have seen this draft - it discusses long-term multi-provider setups rather than transitional ones, so it isn't direcly
on point, but it still has some useful ideas.

https://tools.ietf.org/html/draft-ietf-dnsop-multi-provider-dnssec

So, how is the correct process to add an additional DNSKEY (only the public key is known).

I think you are looking for `dnssec-importkey`.

Tony.
--
f.anthony.n.finch <dot@dotat.at> http://dotat.at/
Viking, North Utsire, South Utsire, Northeast Forties: Northwesterly 4 to 6, becoming variable 2 to 4 except in South Utsire. Slight or moderate. Showers. Good.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Copy: klaus.darilion@nic.at (Klaus Darilion)
Copy: bind-users@lists.isc.org (bind-users@lists.isc.org)

On Wed, Jul 8, 2020 at 11:33 AM Tony Finch <dot@dotat.at> wrote:

Klaus Darilion <klaus.darilion@nic.at> wrote:

A signed zone shall be moved to another DNS provider. Hence I want to
add the public KSK of the gaining DNS provider as additional DNSKEY to
the zone.

I guess you might already have seen this draft - it discusses long-term multi-provider setups rather than transitional ones, so it isn't direcly
on point, but it still has some useful ideas.

https://tools.ietf.org/html/draft-ietf-dnsop-multi-provider-dnssec

Thanks for mentioning our draft Tony. The provider handoff case can just
be considered a transitional state of the multi-provider setup, so the same technique can be applied to Klaus's problem. Klaus's case just needs a
further step of detaching the losing provider later by deleting their ZSK.

Our scheme imports only the ZSK public key rather than the KSK. I don't
think importing the KSK alone works, because the other provider's data
is signed by their ZSK. I suggest looking at the steps outlined in Model 2, which is more applicable to the general case of provider transfer.

So, how is the correct process to add an additional DNSKEY (only the

public key is known).

I think you are looking for `dnssec-importkey`.

Yes, dnssec-importkey works fine with BIND's auto-dnssec configuration
for this task. If you're signing outside BIND (e.g. with dnssec-signzone), I assume you can stitch together the DNSKEY RRset with the imported ZSK
manually or with some scripting.

Shumon Huque

<div dir="ltr"><div dir="ltr">On Wed, Jul 8, 2020 at 11:33 AM Tony Finch &lt;<a href="mailto:dot@dotat.at">dot@dotat.at</a>&gt; wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">Klaus Darilion &lt;<a href="mailto:klaus.darilion@nic.at" target="_blank">klaus.darilion@nic.at</a>&gt; wrote:<br>
&gt;<br>
&gt; A signed zone shall be moved to another DNS provider. Hence I want to<br> &gt; add the public KSK of the gaining DNS provider as additional DNSKEY to<br> &gt; the zone.<br>

I guess you might already have seen this draft - it discusses long-term<br> multi-provider setups rather than transitional ones, so it isn&#39;t direcly<br>
on point, but it still has some useful ideas.<br>

<a href="https://tools.ietf.org/html/draft-ietf-dnsop-multi-provider-dnssec" rel="noreferrer" target="_blank">https://tools.ietf.org/html/draft-ietf-dnsop-multi-provider-dnssec</a></blockquote><div><br></div><div>Thanks for mentioning our draft Tony. The
provider handoff case can just</div><div>be considered a transitional state of the multi-provider setup, so the same</div><div>technique can be applied to Klaus&#39;s problem. Klaus&#39;s case just needs a</div><div>further step of detaching the losing
provider later by deleting their ZSK.</div><div><br></div><div>Our scheme imports only the ZSK public key rather than the KSK.  I don&#39;t</div><div>think importing the KSK alone works, because the other provider&#39;s data</div><div>is signed by their
ZSK. I suggest looking at the steps outlined in Model 2,</div><div>which is more applicable to the general case of provider transfer.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,
204);padding-left:1ex">

&gt; So, how is the correct process to add an additional DNSKEY (only the public key is known).<br>

I think you are looking for `dnssec-importkey`.<br></blockquote><div><br></div><div>Yes, dnssec-importkey works fine with BIND&#39;s auto-dnssec configuration</div><div>for this task. If you&#39;re signing outside BIND (e.g. with dnssec-signzone), I</div>
<div>assume you can stitch together the DNSKEY RRset with the imported ZSK</div><div>manually or with some scripting.</div><div><br></div><div>Shumon Huque</div><div><br></div></div></div>

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)