Right before DNS-OARC 47 we have another beta release of Cascade, together with releases of dnst and the cascade-hsm-bridge. All three have to be upgraded together (though the bridge is only needed for HSM use).
This release sees significant changes to HSM support. Now RSASHA512, ECDSAP384SHA384, ED25519 and ED448 are also supported for HSMs, though ED25519 and ED448 only in combination with cascade-hsm-bridge and not for KMIP in general. For authentication, mTLS is now supported. Less visible, but no less important, are changes to the underlying libraries.
Other significant changes involve the Cascade key manager (dnst keyset). The way TTLs are collected during key rolls has been changed. This affects manual key rolls. A new key roll command ‘before-ttl’ has been added. A side effect of this is that the first signed zone version of a new zone is a bit weird. We are considering if and how this should be corrected in a future release.
The status output during key rolls has been reworked as well. The zone status --detailed command gives additional information about the state of automatic key rolls and should give better instructions to the user.
Smaller changes are
- A zone edit command to change the source and policy of a zone.
- An attic where on-disk keys (and other key manager state) are moved when a zone is removed. HSM keys need to be removed manually.
- A set-last-signed-serial command that can be used to select the next serial for counter policy.
- The zone history is now limited to 1024 items to avoid excessive growth.
- File permissions are more secure.
- The consistency of TTLs in RRsets is verified when a zone is loaded.
- A brand new Cascade logo in the documentation.
Thanks to @jpmens, @bortzmeyer, and @thgoebel for testing Cascade and providing
valuable feedback!