Unable to get authenticated negative responses from BIND 9.6.0 w/ NSEC3?

[Mark Andrews]

In message <A0E00A9B-89CC-4B94-A3A5-49FD22FE3552 at johani.org>, Johan Ihren writes:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I realise this just has to be a user error, but sofar I've been  
> completely unsuccessful in getting an authenticated response from a  
> 9.6.0 recursive server with trusted keys correctly configured.
> 
> I've done this:
> 
> * Signed the zones:
> 
> "parent" is signed with NSEC semantics, key algorithm is RSASHA1
> "child1.parent" is signed with NSEC, key algorithm is RSASHA1
> "child2.parent" is signed with NSEC3, key algorithm is NSEC3RSASHA1

	Did you tell dnssec-signzone to generate NSEC3 chains rather
	than NSEC chains.  NSEC3RSASHA1 allows for both NSEC and
	NSEC3 chains and dnssec-signzone defaults to NSEC chains.

	dnssec-signzone -3 salt [-H iterations] [-A] ....

> * Created the secure delegations:
> 
> the DS records for child1.parent and child2.parent both use the  
> correct algorithm numbers (5 and 7 respectively)
> 
> * Configured a trusted key for "parent" in a recursive server:
> 
> The trusted key is correctly configured, because I'm able to validate  
> positive responses from all three zones (which also proves that the  
> delegations are correctly secured via the DS records). I'm also able  
> to validate negative responses from "parent" and "child1.parent".
> 
> And, yes, I have "dnssec-enable yes; dnssec-validation yes;" in  
> relevant places.
> 
> But I fail to validate the interesting case, i.e. a negative response  
> from child2.parent containing NSEC3 records as the proof. I get the  
> response, with all the NSEC3s and their RRSIGs. But no AD bit.
> 
> Anyone done this recently who can give me a suggestion to where I may  
> go wrong?
> 
> Johan
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.5 (Darwin)
> 
> iD8DBQFJZy3KKJmr+nqSTbYRAgR9AKCioFf7n+IZmKfH0qenvlZnnh6FpQCeLl0e
> w3pw5x1lyPwkJnM3iRGjiP4=
> =tnBX
> -----END PGP SIGNATURE-----
> _______________________________________________
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark_Andrews at isc.org