Hi Thomas,
well, the key tag is a "checksum" of the crypto key material, which is
"random", so with a probability of 1/65536, you obtain two different
keys with equal key tag.
This should be no problem for the operation, you just need to take care
and not use key tag for identifying the keys, for example in keymgr.
Note that in Knot terminology, this short checksum is called 'key tag',
whereas 'key id' is a sha sum which is most probably unique.
BR,
Libor
Dne 03.07.20 v 14:58 Thomas E. napsal(a):
Hi,
I performed a manual key roll over with this command:
$ knotc zone-key-rollover dnssec-test.xxx zsk
The result is 2 different ZSK's with the same key id:
dnssec-test.xxx. 3600 IN DNSKEY 256 3 8 (
AwEAAc5W.....
) ; ZSK; alg = RSASHA256; key id = 7030
dnssec-test.xxx. 3600 IN DNSKEY 256 3 8 (
AwEAAc7Q5U......
) ; ZSK; alg = RSASHA256; key id = 7030
From the log:
2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, key, tag 56464,
algorithm RSASHA256, KSK, public, ready, active+
2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, key, tag 7030,
algorithm RSASHA256, public
2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, key, tag 7030,
algorithm RSASHA256, public, active
2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, signing started
2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, zone is up-to-date
Is it the indented behavior to have two ZSK's with the same key id?
Thanks a lot,
Thomas
--
https://lists.nic.cz/mailman/listinfo/knot-dns-users
