Hi Petr, the ZSK rollover with the two keys having the identical key tag went fine. The only thing that was not so nice was that I could not follow the roll over progress in the log file. In the log I am not able to see which key is which.
Not sure if it's worth the effort to extend the source code to avoid unique keys. I think this a very rare situation. Best, Thomas On 07.07.20 09:23, Petr Špaček wrote: > Hi everyone, > > let me add references: > https://tools.ietf.org/html/rfc4034#appendix-B explains this: >> However, it is essential to note that the key tag is not a unique >> identifier. It is theoretically possible for two distinct DNSKEY RRs >> to have the same owner name, the same algorithm, and the same key >> tag. The key tag is used to limit the possible candidate keys, but >> it does not uniquely identify a DNSKEY record. Implementations MUST >> NOT assume that the key tag uniquely identifies a DNSKEY RR. > > Also key tag "collision" is even more likely than it seems at first glance, > see > https://lists.dns-oarc.net/pipermail/dns-operations/2015-December/013949.html > > One question is if generating keys in a way which quarantees unique key tags > would improve user experience sufficiently to warrant more complexity in key > generation code. > > Petr Špaček @ CZ.NIC > > > On 03. 07. 20 15:08, libor.peltan wrote: >> Hi Thomas, >> >> well, the key tag is a "checksum" of the crypto key material, which is >> "random", so with a probability of 1/65536, you obtain two different keys >> with equal key tag. >> >> This should be no problem for the operation, you just need to take care and >> not use key tag for identifying the keys, for example in keymgr. >> >> Note that in Knot terminology, this short checksum is called 'key tag', >> whereas 'key id' is a sha sum which is most probably unique. >> >> BR, >> >> Libor >> >> Dne 03.07.20 v 14:58 Thomas E. napsal(a): >>> Hi, >>> >>> I performed a manual key roll over with this command: >>> >>> $ knotc zone-key-rollover dnssec-test.xxx zsk >>> >>> >>> The result is 2 different ZSK's with the same key id: >>> >>> >>> dnssec-test.xxx. 3600 IN DNSKEY 256 3 8 ( >>> AwEAAc5W..... >>> ) ; ZSK; alg = RSASHA256; key id = 7030 >>> >>> dnssec-test.xxx. 3600 IN DNSKEY 256 3 8 ( >>> AwEAAc7Q5U...... >>> ) ; ZSK; alg = RSASHA256; key id = 7030 >>> >>> >>> >>> From the log: >>> >>> 2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, key, tag 56464, >>> algorithm RSASHA256, KSK, public, ready, active+ >>> 2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, key, tag 7030, >>> algorithm RSASHA256, public >>> 2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, key, tag 7030, >>> algorithm RSASHA256, public, active >>> 2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, signing started >>> 2020-07-03T14:52:59 info: [dnssec-test.xxx.] DNSSEC, zone is up-to-date >>> >>> >>> >>> Is it the indented behavior to have two ZSK's with the same key id? >>> >>> >>> Thanks a lot, >>> Thomas > -- https://lists.nic.cz/mailman/listinfo/knot-dns-users
