Domain Name System KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag
obsoleted by
- rfc-4033 — DNS Security Introduction and Requirements
- rfc-4034 — Resource Records for the DNS Security Extensions
- rfc-4035 — Protocol Modifications for the DNS Security Extensions
updates
Extracted elements (15)
Since the SEP bit is within the data used to compute the key tag field in the SIG RR, changing the SEP bit changes the key's identity within DNS. Once a key is used to generate signatures, the SEP bit setting must remain constant or verifiers cannot find the relevant KEY RR.
The SEP bit is intended to communicate a DNSKEY's intended use in-band to third parties (parent registries, resolver administrators, signing tools), but is explicitly not intended to influence the DNS resolution or verification protocol.
The term 'SEP' was coined rather than 'KSK' because a key pair can act as both KSK and ZSK simultaneously; using SEP avoids confusion and also removed the temptation to define separate KSK and ZSK flag bits.
Although the SEP flag provides a hint on which public key to use as a trusted root, administrators may choose to ignore the SEP bit when configuring trusted roots for their resolvers — the bit is advisory, not binding.
This document updates RFC 2535 (DNSSEC) and RFC 3755 (DS legacy resolver compatibility). The SEP bit assignment is within the DNSKEY Flags Registry introduced by RFC 3755.
No trust in a key should be inferred from the SEP flag — trust MUST be inferred from an existing chain of trust or an out-of-band exchange.
One SHOULD NOT assign special meaning to a DNSKEY if the SEP bit is set to 0.
The SEP bit is RECOMMENDED to be set (to 1) whenever the public key will be distributed to the parent zone to build the authentication chain or if the key is to be distributed for static configuration in verifiers.
The SEP bit MAY be used by the zone signer to decide whether the public part of the key pair is to be prepared for input to a DS RR generation function.
The SEP bit MUST NOT be used during the resolving and verification process. It is only used to provide a hint about the different administrative properties of the key.
The Secure Entry Point (SEP) flag is a hint-only flag in the DNSKEY RR flags field that differentiates key-signing keys (KSKs) from zone-signing keys (ZSKs) for operational purposes such as DS RR generation and trusted anchor configuration.
IANA assigned bit 15 in the DNSKEY Flags Registry (defined in RFC 3755 Section 4.3) as the Secure Entry Point (SEP) bit.
Automated mechanisms for DS RR rollover using the SEP flag may be vulnerable to replay attacks: a DNSKEY RR set exchange can be replayed, causing the parent to re-create a DS RR from a previously seen key. Parents are encouraged to implement a replay defense, such as a registry of keys used in recent rollovers.
The SEP flag is for administrative use only and must not be used to determine the security status of a key or infer trust. The same replay-attack considerations apply to entities configuring keys in resolvers.
The SEP flag occupies bit 15 (the least significant bit) of the 16-bit flags field in the DNSKEY RR. When set to 1, the key is intended to be used as a secure entry point key; setting it to 0 carries no special meaning.