Uploaded image for project: 'OpenDNSSEC'
  1. OpenDNSSEC
  2. OPENDNSSEC-799

Refactor the usage of keys

    XMLWordPrintable

    Details

    • Type: Story
    • Status: Open
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: 1.4.10, 2.0.0
    • Fix Version/s: future
    • Component/s: None
    • Labels:
      None

      Description

      As a result of OPENDNSSEC-798, we found that there is an architectural problem in OpenDNSSEC. Keys are/were kept in zones across re-openings of the HSM connection. However object identifiers in PKCS#11 are not stable. It is even doubtful you should keep them outside of a logged in connection with an HSM. It would be much better to refactor such that keys are obtained just before starting signing a zone and forgeting them after a pass over the zone. It requires that a key list is passed from the top where a zone sign is started to the bottom modules. This is much better than a cache/lookup table of HSM keys are this will leak memory/keys over time and is unnecessary slow as the keys constantly need to be looked up.

      The keycache implementation of OPENDNSSEC-798 should be removed when performing this refactoring.

        Attachments

          Activity

            People

            Assignee:
            Unassigned
            Reporter:
            berry Berry van Halderen
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Dates

              Created:
              Updated: