Ben writes: > SEP keys do not have a parent!
Terminology overload. Most of us use KSK and SEP interchangably to refer to the same thing, which is a key potentially used in parent DS records or resolver configs. The term KSK (key signing key) was discarded by rfc3757 for being confusingly similar to "ZSK", but it hasn't left the vernacular yet. See http://www.ietf.org/rfc/rfc3757.txt Note that ANY key can be configured into resolvers, whether or not the SEP bit is set and whether or not zones would prefer it to be hard-configured. -- Sam . dnsop resources:_____________________________________________________ web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html
