WikiStart: NSEC_to_NSEC3_Roll_Test_Report.txt

Line 
1 NSEC-to-NSEC3 Roll Test Report
2 ------------------------------
3
4 Synopsis:
5
6 This tested the observed behaviour of several different
7 resolvers/validators before, during and after a roll from NSEC to
8 NSEC3.
9
10
11 Roll states:
12
13 State 1: Initial state (pre-roll):
14
15         An NSEC3-capable authoritative server with NSEC-signed zone
16         using key algorithm 5 (RSASHA1) which had three sub-zones.
17         These were:
18
19         - an unsigned sub-zone [n0.roll.ws.nsec3.org]
20         - a signed sub-zone using NSEC [n1.roll.ws.nsec3.org]
21         - a signed sub-zone using NSEC3 [n3.roll.ws.nsec3.org]
22
23 State 2: Intermediate state (during roll):
24
25         We performed a key rollover to an NSEC-signed zone using
26         key algorithm 133 (NSEC3RSASHA1, i.e. RSASHA1 algorithm with
27         code specially assigned to signal possible use of NSEC3).
28
29 State 3: Final state (post-roll):
30
31         We then signed the zones, replacing the NSEC chain with an
32         NSEC3 chain -- again using key algorithm 133 -- and reloaded
33         the server.
34
35
36 Testing:
37
38 A number of different resolvers/validators were tested:
39
40 - two different NSEC3-aware validators: V1 and V7.
41
42 - two different NSEC-only validators: V3 and V8.
43
44 - several different resolvers which were either DNSSEC-unaware or
45   had DNSSEC disabled: R3, R4, R5, R10, R11.
46
47
48 Result:
49
50 All resolvers/validators returned expected results throughout all
51 three states of the test.
52
53 - The NSEC3-aware validators returned consistent authoritative results
54   during all three states.
55
56 - The NSEC-only-aware validators returned authoritative answers in
57   State 1 and non-authoritative answers in States 2 and 3.
58
59 - The non-DNSSEC-aware resolvers returned expected answers throughout
60   the test.