Hi everyone, let me add references: https://tools.ietf.org/html/rfc4034#appendix-B explains this: > However, it is essential to note that the key tag is not a unique > identifier. It is theoretically possible for two distinct DNSKEY RRs > to have the same owner name, the same algorithm, and the same key > tag. The key tag is used to limit the possible candidate keys, but > it does not uniquely identify a DNSKEY record. Implementations MUST > NOT assume that the key tag uniquely identifies a DNSKEY RR.
Also key tag "collision" is even more likely than it seems at first glance, see https://lists.dns-oarc.net/pipermail/dns-operations/2015-December/013949.html One question is if generating keys in a way which quarantees unique key tags would improve user experience sufficiently to warrant more complexity in key generation code. Petr Špaček @ CZ.NIC On 03. 07. 20 15:08, libor.peltan wrote: > Hi Thomas, > > well, the key tag is a "checksum" of the crypto key material, which is > "random", so with a probability of 1/65536, you obtain two different keys > with equal key tag. > > This should be no problem for the operation, you just need to take care and > not use key tag for identifying the keys, for example in keymgr. > > Note that in Knot terminology, this short checksum is called 'key tag', > whereas 'key id' is a sha sum which is most probably unique. > > BR, > > Libor > > Dne 03.07.20 v 14:58 Thomas E. napsal(a): >> Hi, >> >> I performed a manual key roll over with this command: >> >> $ knotc zone-key-rollover dnssec-test.xxx zsk >> >> >> The result is 2 different ZSK's with the same key id: >> >> >> dnssec-test.xxx. 3600 IN DNSKEY 256 3 8 ( >> AwEAAc5W..... >> ) ; ZSK; alg = RSASHA256; key id = 7030 >> >> dnssec-test.xxx. 3600 IN DNSKEY 256 3 8 ( >> AwEAAc7Q5U...... >> ) ; ZSK; alg = RSASHA256; key id = 7030 >> >> >> >> From the log: >> >> 2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, key, tag 56464, >> algorithm RSASHA256, KSK, public, ready, active+ >> 2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, key, tag 7030, >> algorithm RSASHA256, public >> 2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, key, tag 7030, >> algorithm RSASHA256, public, active >> 2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, signing started >> 2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, zone is up-to-date >> >> >> >> Is it the indented behavior to have two ZSK's with the same key id? >> >> >> Thanks a lot, >> Thomas -- https://lists.nic.cz/mailman/listinfo/knot-dns-users
