You can only use one key to sign the data…
… However, it's way more convenient to use 2 pairs of key (ZSK & KSK). There are 2 important points to take into account:
- You need to regularly refresh the key (ZSK) used to sign the records. (For security reasons.)
- You need to be sure that the DS record in the parent zone corresponds to the key used in the aforementioned zone.
This is very important, any error in the key rollover process would result in a total failure. And each time you would renew your ZSK, you would need to update the parent zone. This is why a KSK is used. This key will only be used to sign the ZSK (and itself). The DS record in the parent zone should correspond to that KSK. You don't need to renew the KSK as often as the ZSK.
The cool thing is that, with these 2 keys, you can renew the ZSK without updating the parent zone! To summarise briefly, you need to:
- Sign the records with the new ZSK.
- Sign the new ZSK with the current KSK.
As long as you don't change the KSK, you don't have to change the DS record in the parent zone.
The KSK of the
.se zone is sent by the
.se nameservers. The hash is sent by the parent zone, the root's nameserver in that case.
Here's briefly how DNSSEC works:
- The resolver gets a record, along with its signature (RRSIG) signed with the zone's ZSK.
To allow the resolver to check that signature, it also gets the ZSK, and its signature (RRSIG) signed with the KSK.
To allow the resolver to check that signature, it also gets the KSK, and its signature (RRSIG) signed with the KSK. (self-signed)
You can see that, if you trust the algorithms used, everything is as secure as the KSK is. But the KSK is sent by the same nameserver that sent you the record! It could seem pretty useless, but not really…
- The resolver gets from the parent zone the DS record for the aforementioned zone. This DS records is a digest of the aforementioned zone KSK.
As you can see, as long as you trust the parent zone, you can trust the KSK used, and thus the record.
That's how DNSSEC works: that DS record is also signed by the parent zone ZSK, like the record was in the child zone. You check it with the ZSK, the KSK, and the DS record of the parent of the parent zone. And so on and so forth until you reach the root zone. The root's KSK are hardcoded in the resolver.
Note: the key rollover process is slightly more complicated. Because of resolvers caching data, you might need to keep old records (signatures) for a time.