-
Type:
Story
-
Status: Open
-
Priority:
Minor
-
Resolution: Unresolved
-
Affects Version/s: 1.4.10, 2.0.0
-
Fix Version/s: future
-
Component/s: None
-
Labels:None
As a result of OPENDNSSEC-798, we found that there is an architectural problem in OpenDNSSEC. Keys are/were kept in zones across re-openings of the HSM connection. However object identifiers in PKCS#11 are not stable. It is even doubtful you should keep them outside of a logged in connection with an HSM. It would be much better to refactor such that keys are obtained just before starting signing a zone and forgeting them after a pass over the zone. It requires that a key list is passed from the top where a zone sign is started to the bottom modules. This is much better than a cache/lookup table of HSM keys are this will leak memory/keys over time and is unnecessary slow as the keys constantly need to be looked up.
The keycache implementation of OPENDNSSEC-798 should be removed when performing this refactoring.