Here just some thoughts (some of them very internal regarding coding) to implementation of offline keys feature.
Requirements:
The target is enabling zone singing and ZSK rollovers without touching KSK private key.
The motivation is that this key might be stored in some safe safe, not available for everyday access.
Occasionally, the user gives us the KSK, we pre-generate all the ZSKs for future rollovers and pre-sign all future DNSKEY rrsets.
Design:
The pre-generated ZSKs will be stored in our keystore (incl. KASP database), but their publish (and other) timers will be simply in the future. Thus, we can easily use "manual" key rolling policy.
The pre-generated DNSKEY RRSIGs will be also stored in KASP.
Code design:
-
Signing procedure uses pre-generated stuff
- Load_zone_keys must be able to continue w/o KSK private
- DNSKEY RRSIG must be taken from KASP
-
Generating mode - in keymgr?
- Simply using signing context with modified "now" (double-check this has no side-effects!)
- Using zone_sign_update to avoid useless re-signing of whole zone (we will extract just DNSKEY RRSIG anyway)