Hi Klaus,
On 11/14/2013 08:25 AM, Klaus Darilion wrote:
> Hi! Using ODS 1.3.15 and nCipher HSMs:
>
> The key itself is identical, but the calculated tag differs when
> calculated by ods-hsmutil: KSKs have an offset of 4 (and reported falsly
> as ZSK), ZSKs have an offset of 3.
The reason for this is that ods-ksmutil has knowledge over the kasp
database. Thus, it knows which DNSKEY algorithm and which flags are used
for keys.
'ods-hsmutil dnskey' makes a RSA-SHA1 (5) ZSK key given a CKA_ID. The
algorithm and flags are hard coded in the source.
Best regards,
Matthijs
>
> See output below.
>
> Thanks
> Klaus
>
> # ods-ksmutil key list -v
> SQLite database set to: /var/lib/opendnssec/db/kasp.db
> Keys:
> Zone: Keytype: CKA_ID: Keytag:
> renamed KSK f2c291c81ecc6014e2d80f6cd2f4c9e1 47764
>
>
> ods-ksmutil key export --zone renamed
> ;active KSK DNSKEY record:
> renamed. 3600 IN DNSKEY 257 3 8
> AwEAAatfpcBwA9w1fEh7a5d43Nrd8ogcVrUzS+24zPV5fzdBmQOK1YIyY0sMnsSTRTCa/G/HfTOtEYVwxVvxqNIek/zWJKvJP5ZFGYh/RSCFDdHVvXhDUqNP5hqoZitipetZ9JcxjjZ7FSCcboCv1vQcXxSWUhrx0lNyLilKtqA2w9CPpajSwVr1gNAOJkAqLc8noEKSPzJIf068sc5Vr8mocXuC2JUhqSqTqbOX++WH6NgXH4T2u3SSsZZ0y7Ik1iCQPvenMPUJpgWMHKECEePUzH88fVN2hY9k8AoNNz9OHii8TCfQYwe10bEfkud5ISwrQDx/nk/30G06GN3mZpOm53k=
> ;{id = 47764 (ksk), size = 2048b}
>
>
> # ods-hsmutil dnskey f2c291c81ecc6014e2d80f6cd2f4c9e1 renamed
> renamed. 3600 IN DNSKEY 256 3 5
> AwEAAatfpcBwA9w1fEh7a5d43Nrd8ogcVrUzS+24zPV5fzdBmQOK1YIyY0sMnsSTRTCa/G/HfTOtEYVwxVvxqNIek/zWJKvJP5ZFGYh/RSCFDdHVvXhDUqNP5hqoZitipetZ9JcxjjZ7FSCcboCv1vQcXxSWUhrx0lNyLilKtqA2w9CPpajSwVr1gNAOJkAqLc8noEKSPzJIf068sc5Vr8mocXuC2JUhqSqTqbOX++WH6NgXH4T2u3SSsZZ0y7Ik1iCQPvenMPUJpgWMHKECEePUzH88fVN2hY9k8AoNNz9OHii8TCfQYwe10bEfkud5ISwrQDx/nk/30G06GN3mZpOm53k=
> ;{id = 47760 (zsk), size = 2048b}
>
>
> _______________________________________________
> Opendnssec-user mailing list
> [email protected]
> https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
_______________________________________________
Opendnssec-user mailing list
[email protected]
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
