On Thu, 2020-01-09 at 20:19 -0500, Viktor Dukhovni wrote: > If/when you do decide to switch algorithms, please perform the migration > with care. Algorithm rollovers can be tricky. The basic process is: > > 1. Publish and activate a ZSK for the new algorithm. Your zone > should now be double-signed, which each record having two > RRSIGs. Don't forget to bump the SOA.
Your zone is now bogus. > The reason for all this is to maintain the followin invariants: > > A. Each algorithm mentioned in the parent zone DS RRset must > have a matching KSK in the zone's DNSKEY RRset. > > B. Each KSK algorithm appearing in the zone's DNSKEY RRset > must have a corresponding ZSK signature for each record > in the zone. You are missing: C. Each algorithm for which a DNSKEY exists, must sign all the records in the zone. Because of caching, step 1 potentially breaks this invariant. https://tools.ietf.org/html/rfc6781#section-4.1.4 explains this at length (with better wording than I used), and appears to get it right. Kind regards, -- Peter van Dijk PowerDNS.COM BV - https://www.powerdns.com/
