Re: Validation succeeds when keys with multiple algorithms present, but not RRSIGs for both

2013-08-02 Thread Mark Andrews
In message , Casey Deccio writes: > On Fri, Aug 2, 2013 at 5:25 AM, Mark Andrews wrote: > > > > In message <51fb9c18.23133.401e...@tmorizot.sd.is.irs.gov>, "Scott Morizot" > wri > > tes: > >> The BIND 9 resolver returns an answer with the AD bit set. Unbound > >> returns SERVFAIL. Secure64 Cach

Re: Validation succeeds when keys with multiple algorithms present, but not RRSIGs for both

2013-08-02 Thread Casey Deccio
On Fri, Aug 2, 2013 at 5:25 AM, Mark Andrews wrote: > > In message <51fb9c18.23133.401e...@tmorizot.sd.is.irs.gov>, "Scott Morizot" > wri > tes: >> The BIND 9 resolver returns an answer with the AD bit set. Unbound >> returns SERVFAIL. Secure64 Caches also return SERVFAIL. Those are the >> only t

Re: Validation succeeds when keys with multiple algorithms present, but not RRSIGs for both

2013-08-02 Thread Mark Andrews
In message <51fbad70.9183.445a...@tmorizot.sd.is.irs.gov>, "Scott Morizot" writes: > On 2 Aug 2013 at 22:25, Mark Andrews wrote: > > In message <51fb9c18.23133.401e...@tmorizot.sd.is.irs.gov>, "Scott Morizot" > > wri > > tes: > > > Hello all, > > > > > > I ran into an interesting situation reso

Re: Validation succeeds when keys with multiple algorithms present, but not RRSIGs for both

2013-08-02 Thread Scott Morizot
On 2 Aug 2013 at 22:25, Mark Andrews wrote: > In message <51fb9c18.23133.401e...@tmorizot.sd.is.irs.gov>, "Scott Morizot" > wri > tes: > > Hello all, > > > > I ran into an interesting situation resolving dfas.mil. It appears that > > they have attempted to roll their ZSKs to algorithm 8 while le

Re: Validation succeeds when keys with multiple algorithms present, but not RRSIGs for both

2013-08-02 Thread Mark Andrews
In message <51fb9c18.23133.401e...@tmorizot.sd.is.irs.gov>, "Scott Morizot" wri tes: > Hello all, > > I ran into an interesting situation resolving dfas.mil. It appears that > they have attempted to roll their ZSKs to algorithm 8 while leaving their > KSKs on algorithm 7. Unfortunately, RFC 403

Validation succeeds when keys with multiple algorithms present, but not RRSIGs for both

2013-08-02 Thread Scott Morizot
Hello all, I ran into an interesting situation resolving dfas.mil. It appears that they have attempted to roll their ZSKs to algorithm 8 while leaving their KSKs on algorithm 7. Unfortunately, RFC 4035 specifies that if DNSKEYs for multiple algorithms exist in the apex DNSKEY RRset, then an RRS