DNSSEC ZSK compromisation (man-in-the-middle attack)

Question

Assuming I am administering a DNS zone and I operate an authoritative name server that is secured with DNSSEC (split ZSK/KSK setup).

When the Zone-Signing-Key (ZSK) ever gets compromised, would it be enough to resign the zone with a newly generated ZSK or would the KSK also needed to be exchanged (and the according DS record inserted into the parent zone) as well?

My concern is that a man-in-the-middle could use the compromised ZSK to generate fake records without a resolver being able to detect this, if he simultaneously publishes the old ZSK instead of the new one. I am neither aware of a revoking mechanism for Zone-Signing-Keys nor does it seem possible to also sign a "ZSK key inactive date" with the KSK.

Am I missing something or would the compromisation of the ZSK therefore require an exchange of the KSK, too? Also, what are the main advantages of a split ZSK/KSK setup in this case?

Answer 1

The split ZSK/KSK main benefit is to be able to change the ZSKs very often, as they are under your control completely, while for the KSKs, if you change it, you need to update the associated DS record in your parent zone, which is not always something 100% automated. This is why KSKs have typically 1 or 2 years of validity, where ZSKs are more like 1 month.

In your case, if the ZSK is compromised, you need to remove it immediately from your zone, add a new one which will sign everything else, and make sure it is signed itself by your KSKs.

If your ZSKs is compromised because, for example, it was on an HSM and you have the KSKs at the same place, then if you are paranoid you should suspect that everything may be compromised, which means changing all your keys in emergency, contacting your parent zone, trying to ask major DNS resolvers to flush their cache after your new setup, etc… Of course same thing if it was a "SoftHSM" setup.

But if only the ZSK is compromised, resolvers will detect it if it used to sign records because your KSK would not sign this ZSK anymore, hence breaking the DNSSEC chain of trust.