Track3Sec: 2.6_dnssec-bind-manual-ksk-rollover.txt

Manual Key Rollover Exercise

OBJECTIVE

We are going to roll the KSK for the zones we have just signed.

REMINDERS

 - we are keeping our keys in /etc/namedb/keys/

 - we currently have two or more keys in that directory, one KSK 
   and one or more ZSKs.
   Each key is represented by two files, one ending in ".key" (the
   public key) and one ending in ".private" (the private key)

 - there is a DS RRSet in the "root" zone corresponding to our KSK


KSK ROLLOVER

The process is rather similar to the ZSK rollover:

1. Go to the key dir:

    # cd /etc/namedb/keys/
    # ls -lt K*

2. Just like in step 2 of the ZSK rollover, generate a new KSK
   You will need to use the "-f KSK" parameter to dnssec-keygen:

    # dnssec-keygen -f KSK -a RSASHA256 -b 2048 -n ZONE mytld

    which might output:
    Kmytld.+008+54511

3. Calculate a DS RRSet for the new KSK.

  # cd /etc/namedb/keys/
  # dnssec-dsfromkey Kmytld.+008+54511.key | tee dsset-mytld-54511.

  (here 54511 is just the ID of the new KSK so we know which DS is
  which).

4. Upload the dsset for your zone, using the RZM web interface.

   Using web interface, login as before.
   Under the "Edit Trust Anchor Details" section enter:

   Key Tag, 

   Digest

   Algorithm

   Digest type 

   from the output of step 3 above. E.g., for

   mytld. IN DS 54511      8          2          983F33D43D1EBB069BF60...
                 TAG    Algorithm  Digest-Type       Digest
                        RSASHA256

   Make sure to eliminate any spaces from the Digest and note that 
   you only need one trust anchor. (longer one is preferred)

   Click "Update" when done.  Wait a minute for update to propagate.


5. Double check that the new DS is published in the parent (root) zone
    alongside the existing one (you should wait at least 2 x TTL 
    until all the caches are updated):

   # dig @10.10.0.230 DS mytld
   ...
   ;; ANSWER SECTION:
   mytld    900 IN  DS 52159 8 2 31F1...
   mytld    900 IN  DS 54511 8 2 983F...  // <-- the new KSK
   ...

   Since both DS are now present in the world's caches and
   DNSSEC requires only one chain of trust to validate, 
   we can roll our KSK.


   Add the new KSK to the zone (edit the file), and we comment
   out (remove) the old KSK like this:

        ;$include "/etc/namedb/keys/Kmytld.+008+52159.key"; // KSK old
        $include "/etc/namedb/keys/Kmytld.+008+54511.key"; // KSK new

    Remember to increment the serial number too.

    ... notice how we simply get rid of the old KSK - we don't need
    it - both DS records are there, so it's enough to have only one
    KSK, since we already "know" about its DS "on the internet".

6. Let's sign the zone with the new KSK

  # cd /etc/namedb/keys
  # dnssec-signzone -x -o mytld -k Kmytld.+008+54511 ../master/mytld

  # rndc reload mytld

7. Check with dig - both before and after the TTL expire (or cache flush)

  # dig dnskey mytld +multi
  # dig dnskey mytld +dnssec +multi

  Notice that the tag for the KSK (the longer one) has changed to
  the new one and that the "ad" Authenticated Data bit is still set.
 
8. Remove the original DS resouce record from the "root" using 
   the RZM web interface by logging in; clicking on the icon
   next to the old DS record until you get "X"; then click
   "Update".

   After a minute, the old DS record should be gone from the root.

   You can check with:

   # dig DS mytld

9. Sit back and reflect on what an involved and annoying process
   this was, and how much better things would be if all your key
   rollovers were managed automatically.