middleware/dnssec/README.md

# dnssec

*dnssec* enables on-the-fly DNSSEC signing of served data.

## Syntax

~~~
dnssec [ZONES...]
~~~

* **ZONES** zones that should be signed. If empty, the zones from the configuration block
    are used.

If keys are not specified (see below), a key is generated and used for all signing operations. The
DNSSEC signing will treat this key a CSK (common signing key), forgoing the ZSK/KSK split. All
signing operations are done online. Authenticated denial of existence is implemented with NSEC black
lies. Using ECDSA as an algorithm is preferred as this leads to smaller signatures (compared to
RSA). NSEC3 is *not* supported.

A single signing key can be specified by using the `key` directive.

NOTE: Key generation has not been implemented yet.

TODO(miek): think about key rollovers, and how to do them automatically.

~~~
dnssec [ZONES... ] {
    key file KEY...
}
~~~

* `key file` indicates that key file(s) should be read from disk. When multiple keys are specified, RRsets
  will be signed with all keys. Generating a key can be done with `dnssec-keygen`: `dnssec-keygen -a
  ECDSAP256SHA256 <zonename>`. A key created for zone *A* can be safely used for zone *B*.

## Examples
Add middleware/dnssec (#133) This adds an online dnssec middleware. The middleware will sign responses on the fly. Negative responses are signed with NSEC black lies. 2016-04-26 17:57:11 +01:00			`# dnssec`

docs: rewrite using manpage style (#327) This still needs cleanup, but this is a first pass the cleans some cruft and documents our style (in middleware.md) and makes all the docs match that style. 2016-10-10 20:13:22 +01:00			`dnssec enables on-the-fly DNSSEC signing of served data.`
Add middleware/dnssec (#133) This adds an online dnssec middleware. The middleware will sign responses on the fly. Negative responses are signed with NSEC black lies. 2016-04-26 17:57:11 +01:00
			`## Syntax`

			`~~~`
docs: rewrite using manpage style (#327) This still needs cleanup, but this is a first pass the cleans some cruft and documents our style (in middleware.md) and makes all the docs match that style. 2016-10-10 20:13:22 +01:00			`dnssec [ZONES...]`
Add middleware/dnssec (#133) This adds an online dnssec middleware. The middleware will sign responses on the fly. Negative responses are signed with NSEC black lies. 2016-04-26 17:57:11 +01:00			`~~~`

docs: rewrite using manpage style (#327) This still needs cleanup, but this is a first pass the cleans some cruft and documents our style (in middleware.md) and makes all the docs match that style. 2016-10-10 20:13:22 +01:00			`* ZONES zones that should be signed. If empty, the zones from the configuration block`
Add middleware/dnssec (#133) This adds an online dnssec middleware. The middleware will sign responses on the fly. Negative responses are signed with NSEC black lies. 2016-04-26 17:57:11 +01:00			`are used.`

Update README.md 2016-08-22 14:04:21 -07:00			`If keys are not specified (see below), a key is generated and used for all signing operations. The`
			`DNSSEC signing will treat this key a CSK (common signing key), forgoing the ZSK/KSK split. All`
Add middleware/dnssec (#133) This adds an online dnssec middleware. The middleware will sign responses on the fly. Negative responses are signed with NSEC black lies. 2016-04-26 17:57:11 +01:00			`signing operations are done online. Authenticated denial of existence is implemented with NSEC black`
			`lies. Using ECDSA as an algorithm is preferred as this leads to smaller signatures (compared to`
Update docs Update the file and dnssec docs and glarify what is implement and that we only do NSEC. 2016-08-29 19:15:04 +01:00			`RSA). NSEC3 is not supported.`
Add middleware/dnssec (#133) This adds an online dnssec middleware. The middleware will sign responses on the fly. Negative responses are signed with NSEC black lies. 2016-04-26 17:57:11 +01:00
Fs (#242) * play around with fs idea * docs and fix test * better docs 2016-09-05 09:32:11 +01:00			A single signing key can be specified by using the `key` directive.
Add middleware/dnssec (#133) This adds an online dnssec middleware. The middleware will sign responses on the fly. Negative responses are signed with NSEC black lies. 2016-04-26 17:57:11 +01:00
Update docs Update the file and dnssec docs and glarify what is implement and that we only do NSEC. 2016-08-29 19:15:04 +01:00			`NOTE: Key generation has not been implemented yet.`
middleware/dnssec Add warning about in memory keys and the impossibilty to extract them. 2016-08-14 07:30:41 -07:00
Update docs Update the file and dnssec docs and glarify what is implement and that we only do NSEC. 2016-08-29 19:15:04 +01:00			`TODO(miek): think about key rollovers, and how to do them automatically.`
Add middleware/dnssec (#133) This adds an online dnssec middleware. The middleware will sign responses on the fly. Negative responses are signed with NSEC black lies. 2016-04-26 17:57:11 +01:00
			`~~~`
docs: rewrite using manpage style (#327) This still needs cleanup, but this is a first pass the cleans some cruft and documents our style (in middleware.md) and makes all the docs match that style. 2016-10-10 20:13:22 +01:00			`dnssec [ZONES... ] {`
			`key file KEY...`
Add middleware/dnssec (#133) This adds an online dnssec middleware. The middleware will sign responses on the fly. Negative responses are signed with NSEC black lies. 2016-04-26 17:57:11 +01:00			`}`
			`~~~`

Update README.md 2016-08-22 14:04:21 -07:00			* `key file` indicates that key file(s) should be read from disk. When multiple keys are specified, RRsets
Add middleware/dnssec (#133) This adds an online dnssec middleware. The middleware will sign responses on the fly. Negative responses are signed with NSEC black lies. 2016-04-26 17:57:11 +01:00			will be signed with all keys. Generating a key can be done with `dnssec-keygen`: `dnssec-keygen -a
			ECDSAP256SHA256 <zonename>`. A key created for zone A can be safely used for zone B.

			`## Examples`