RFC 3757

Domain Name System KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag

📅 published May 2004, from ietf

RFC 3757: Domain Name System KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag 🎀

Okay bestie, this is RFC 3757, and it's all about giving DNSKEY records a Secure Entry Point (SEP) flag 💅✨ It was written by O. Kolkman from the RIPE NCC, J. Schlyter from NIC-SE, and E. Lewis from ARIN 🌸 It's a Standards Track doc from April 2004, and it updates RFC 3755 and RFC 2535. It doesn't obsolete anything, so no drama there 🫶

Status of this Memo 📋

This document specifies an Internet standards track protocol for the Internet community, and it asks for discussion and suggestions for improvements 💜 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🦋

Copyright Notice ©

Abstract 🧚

So the Delegation Signer (DS) resource record (RR) brought in the idea of a public key acting as a secure entry point (SEP) 👑 When you swap public keys with the parent, you need a way to tell SEP keys apart from the other public keys in the Domain Name System KEY (DNSKEY) resource record set 🍓 That's where a flag bit in the DNSKEY RR comes in. It says that this DNSKEY is meant to be used as a SEP. The flag helps with operational procedures, like generating DS resource records correctly, or spotting which DNSKEYs are meant for static configuration 🔥 The flag is NOT supposed to be used in the DNS verification protocol, so keep it out of there 🙈 This document updates RFC 2535 and RFC 3755.

Table of Contents 🗂️

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
   2.  The Secure Entry Point (SEP) Flag. . . . . . . . . . . . . . .  4
   3.  DNSSEC Protocol Changes. . . . . . . . . . . . . . . . . . . .  4
   4.  Operational Guidelines . . . . . . . . . . . . . . . . . . . .  4
   5.  Security Considerations. . . . . . . . . . . . . . . . . . . .  5
   6.  IANA Considerations. . . . . . . . . . . . . . . . . . . . . .  6
   7.  Internationalization Considerations. . . . . . . . . . . . . .  6
   8.  Acknowledgments. . . . . . . . . . . . . . . . . . . . . . . .  6
   9.  References . . . . . . . . . . . . . . . . . . . . . . . . . .  6
       9.1.  Normative References . . . . . . . . . . . . . . . . . .  6
       9.2.  Informative References . . . . . . . . . . . . . . . . .  6
   10. Authors' Addresses . . . . . . . . . . . . . . . . . . . . . .  7
   11. Full Copyright Statement . . . . . . . . . . . . . . . . . . .  8

1. Introduction ✨

"All keys are equal but some keys are more equal than others" [6]. 😭

Okay so, once the Delegation Signer Resource Record (DS RR) [5] showed up, it became really important to tell apart the keys in the DNSKEY RR set that parental DS RRs point to (or are going to point to) from all the other keys in that set 💖 We call these public keys Secure Entry Point (SEP) keys. A SEP key is either used to generate a DS RR, or it gets handed out to resolvers that use it as the root of a trusted subtree [3] 🌸

In early deployment tests, people mostly used two kinds of key pairs for each zone 🧁 For one kind, the private key only signs the zone's DNSKEY resource record (RR) set. Its public key is meant to be referenced by a DS RR at the parent, or configured statically in a resolver. The private key of the other kind signs the rest of the zone's data sets. The first pair is called a key-signing key (KSK), and the second is called a zone-signing key (ZSK). In practice there's usually one of each, but sometimes there are multiples of each 💅

Here's the thing: splitting key pairs into KSK's and ZSK's is NOT required by any definition of DNSSEC, not even after the DS RR showed up 🙈 But in testing, the split was super helpful when designing key roll over (key super-cession) schemes 🔥 Since it proved so useful, the labels KSK and ZSK have started to stick 🎀

So we need to tell apart the public keys for key pairs used for key signing from the ones that aren't (KSKs vs ZSKs) 🦋 This matters because you have to know which DNSKEYs get sent off to generate DS RRs, which DNSKEYs get distributed to resolvers, and which keys get fed to the signer application at the right time ⭐

Basically, the SEP bit gives you an in-band way to tell third parties what a DNSKEY RR is meant to be used for 🧚 Here are 3 use cases where the bit is useful:

The parent is a registry, and the parent and child use secured DNS queries and responses (with a preexisting trust-relation), or plain DNS over a secured channel, to swap the child's DNSKEY RR sets. Since a DNSKEY RR set will contain a complete DNSKEY RRset, the SEP bit can be used to isolate the DNSKEYs that need a DS RR created for them 💜
An administrator has configured a DNSKEY as the root for a trusted subtree in a security aware resolver. Using a special purpose tool that queries for the KEY RRs from that domain's apex, the administrator can notice a roll over of the trusted anchor by seeing a change in the subset of KEY RRs with the DS flag set 👑
A signer might use the SEP bit on the public key to decide which private key to use to exclusively sign the DNSKEY RRset, and which private key to use to sign the other RRsets in the zone 🍓

As shown in those examples, it's really important to tell SEP keys apart from the other keys in a DNSKEY RR set, both in the flow between the signer and the (parental) key-collector and in the flow between the signer and the resolver configuration 🔥 The SEP flag is of no interest to the flow between the verifier and the authoritative data store 🙈

The reason it's called "SEP" is that the split between KSK and ZSK key pairs is made by the signer, and a key pair could be used as both a KSK and a ZSK at the same time 😭 To be clear, the term SEP was coined to lessen the confusion caused by that overlap. (Once that label was applied, it also took away the temptation to have both a KSK flag bit and a ZSK flag bit 💀)

The key words "MAY","MAY NOT", "MUST", "MUST NOT", "REQUIRED", "RECOMMENDED", "SHOULD", and "SHOULD NOT" in this document are to be interpreted as described in BCP 14, RFC 2119 [1] 🫶

2. The Secure Entry Point (SEP) Flag 🎀

                        1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |              flags          |S|   protocol    |   algorithm   |
   |                             |E|               |               |
   |                             |P|               |               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               /
   /                        public key                             /
   /                                                               /
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                          DNSKEY RR Format

This document gives the 15th bit in the flags field the job of being the secure entry point (SEP) bit 💖 If the bit is set to 1, the key is meant to be used as a secure entry point key ✨ If it's set to 0, one SHOULD NOT assign special meaning to the key 🙅‍♀️ Operators can spot a secure entry point key by checking whether the decimal representation of the flag field is even or odd 🧮

3. DNSSEC Protocol Changes 🔄

The bit MUST NOT be used during the resolving and verification process 🚫 The SEP flag only gives a hint about the key's different administrative properties. That's why using it doesn't change the DNS resolution protocol or the resolution process at all 🌸

4. Operational Guidelines 🛠️

The SEP bit is set by the key-pair-generator, and the zone signer MAY use it to decide whether the public part of the key pair should be prepared for input to a DS RR generation function 🍓 The SEP bit is recommended to be set (to 1) whenever the public key of the key pair will be distributed to the parent zone to build the authentication chain, or if the public key is going to be distributed for static configuration in verifiers 🦋

When a key pair is created, the operator needs to say whether the SEP bit should be set in the DNSKEY RR 🧠 Since the SEP bit is part of the data used to compute the 'key tag field' in the SIG RR, changing the SEP bit changes the identity of the key within DNS 😱 So once a key is used to generate signatures, the SEP bit setting has to stay constant. Otherwise, a verifier won't be able to find the relevant KEY RR 💀

When signing a zone, the key(s) with the SEP bit set (if any exist) are meant to be used to sign the KEY RR set of the zone 👑 The same key can also sign the rest of the zone data 💅 It's possible that not every key with the SEP bit set will sign the DNSKEY RR set, since those keys might be pending retirement or not yet in use ⏳

When verifying an RR set, the SEP bit isn't meant to play a role 🙈 How the verifier uses the key isn't supposed to be something you think about at key creation time ✨

Even though the SEP flag hints at which public key should be used as the trusted root, administrators can choose to ignore whether a DNSKEY has its SEP bit set when they configure a trusted root for their resolvers 🫶

You can automate a key roll over using the SEP flag 🔥 The parent can use an existing trust relation to verify DNSKEY RR sets where a new DNSKEY RR with the SEP flag shows up 🎀

Okay that's the first half, bestie 🦋💖

8. Acknowledgments ✨

okay bestie, big thanks time 🫶 The ideas in this document came from lots of conversations with people, plus ideas other folks had already published. Mark Andrews, Rob Austein, Miek Gieben, Olafur Gudmundsson, Daniel Karrenberg, Dan Massey, Scott Rose, Marcos Sanz and Sam Weiler all contributed ideas and gave feedback. literal legends 👑

This document was born during a workshop on DNSSEC operations hosted by USC/ISI in August 2002. the origin story is giving 🌸

9. References

9.1. Normative References

[1] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[2] Eastlake, D., "Domain Name System Security Extensions", RFC 2535, March 1999.
[3] Lewis, E., "DNS Security Extension Clarification on Zone Status", RFC 3090, March 2001.
[4] Weiler, S., "Legacy Resolver Compatibility for Delegation Signer (DS)", RFC 3755, April 2004.

9.2. Informative References

[5] Gudmundsson, O., "Delegation Signer (DS) Resource Record (RR)", RFC 3658, December 2003.
[6] Orwell, G. and R. Steadman (illustrator), "Animal Farm; a Fairy Story", ISBN 0151002177 (50th anniversary edition), April 1996.

Yes, [6] is a novel and not a protocol spec. Reference list chaos, but we love a plot twist 🙈📚

10. Authors' Addresses

Here's where you can find the authors 🦋

Olaf M. Kolkman
RIPE NCC
Singel 256
Amsterdam  1016 AB
NL

Phone: +31 20 535 4444
EMail: olaf@ripe.net
URI:   http://www.ripe.net/

Jakob Schlyter
NIC-SE
Box 5774
SE-114 87 Stockholm
Sweden

EMail: jakob@nic.se
URI:   http://www.nic.se/

Edward P. Lewis
ARIN
3635 Concorde Parkway Suite 200
Chantilly, VA  20151
US

Phone: +1 703 227 9854
EMail: edlewis@arin.net
URI:   http://www.arin.net/

11. Full Copyright Statement

Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78 and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

The IETF takes no position on whether any Intellectual Property Rights or other rights that might be claimed to cover the technology in this document are valid or in scope, or whether any license under those rights might be available. It also doesn't claim to have made any independent effort to find such rights. Info about how RFC rights work lives in BCP 78 and BCP 79 🧚

Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the result of an attempt to get a general license or permission for implementers or users to use these proprietary rights can be found in the IETF's online IPR repository at http://www.ietf.org/ipr.

The IETF invites anyone interested to bring to its attention any copyrights, patents, patent applications or other proprietary rights that might cover technology needed to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org 💜

Acknowledgement

Funding for the RFC Editor function is currently provided by the Internet Society. the people behind the scenes are everything 🌈

📦 where this page comes from

ietf: rfc3757 2004-05
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms