Re: Deprecating DNSSEC algorithms 5 (RSASHA1) and 7 (RSASHA1-NSEC3-SHA1)

On Thu, 2020-01-09 at 20:19 -0500, Viktor Dukhovni wrote:

If/when you do decide to switch algorithms, please perform the migration with care. Algorithm rollovers can be tricky. The basic process is:

1.  Publish and activate a ZSK for the new algorithm.  Your zone
    should now be double-signed, which each record having two
    RRSIGs.  Don't forget to bump the SOA.

Your zone is now bogus.

The reason for all this is to maintain the followin invariants:

A. Each algorithm mentioned in the parent zone DS RRset must
   have a matching KSK in the zone's DNSKEY RRset.

B. Each KSK algorithm appearing in the zone's DNSKEY RRset
   must have a corresponding ZSK signature for each record
   in the zone.

You are missing:

C. Each algorithm for which a DNSKEY exists, must sign all the records in the zone.

Because of caching, step 1 potentially breaks this invariant.

https://tools.ietf.org/html/rfc6781#section-4.1.4 explains this at length (with better wording than I used), and appears to get it right.

Kind regards,