Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Key Roles – KSK/ZSK<br />
• DNSKEY RRset usually<br />
has multiple keys, often<br />
<strong>with</strong> split roles.<br />
• KSK (Key signing key)<br />
• Signs (<strong>on</strong>ly) the DNSKEY<br />
RRset.<br />
• Corresp<strong>on</strong>ds to DS records<br />
in parent, providing “secure<br />
entry point” into z<strong>on</strong>e.<br />
• ZSK (Z<strong>on</strong>e signing key)<br />
• Signs the rest of the z<strong>on</strong>e.<br />
com<br />
example.com<br />
…<br />
DNSKEY<br />
Z<strong>on</strong>e data<br />
DS<br />
DNSKEY (KSK)<br />
DNSKEY (ZSK)<br />
Z<strong>on</strong>e data<br />
Verisign Public<br />
19
Change language