|
|
|
0. Root
(".") KSK is manually configured into all resolvers as
"trusted key";
|
|
1. Root zone
itself contains KSK and ZSK (2983)
|
|
2. ... and the signature over the ZSK
_with_ (by) the trusted KSK.
|
|
3. DS record of
the child ("net") is signed with the ZSK (note: italic style).
|
|
---
|
|
4. DS record in
the "root" zone points to the KSK of the "net" zone.
|
|
5. With the
KSK, the ZSK of the "net" zone is signed, which produces the SIG
record over the KSK (by the ZSK).
|
|
6. ZSK is also
used to sign the DS record of "ripe(.net)".
|
|
---
|
|
All over again:
|
|
7. DS record in
he parent ("net") points to the KSK of "ripe.net".
|
|
"ripe.net"
has two keys: KSK and ZSK;
|
|
8. KSK is used
to sign the ZSK
|
|
(hence,
SIGnature by KSK over ZSK)
|
|
9. ZSK (italic)
is used to sign the zone data, including the A record for "www"
(hence, SIGnature by ZSK over A)
|