Use 2048 bits as the default ZSK RSA key size in dnssec-keygen

diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index aae310341da037ed5a038483e5adf92093a8d3df..be6779ca1dd97401f86c1bb6fff1fde87ed52c6f 100644 (file)
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -554,11 +554,7 @@ main(int argc, char **argv) {
                        case DST_ALG_NSEC3RSASHA1:
                        case DST_ALG_RSASHA256:
                        case DST_ALG_RSASHA512:
-                               if ((kskflag & DNS_KEYFLAG_KSK) != 0) {
-                                       size = 2048;
-                               } else {
-                                       size = 1024;
-                               }
+                               size = 2048;
                                if (verbose > 0) {
                                        fprintf(stderr, "key size not "
                                                        "specified; defaulting"

diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
index 8d157adb54a86a262c16693f4290b53609f71038..5833b798419f74a764de8407f3f8a6585896b288 100644 (file)
--- a/bin/dnssec/dnssec-keygen.docbook
+++ b/bin/dnssec/dnssec-keygen.docbook
@@ -176,10 +176,8 @@
          </para>
          <para>
            If the key size is not specified, some algorithms have
-           pre-defined defaults.  For example, RSA keys for use as
-           DNSSEC zone signing keys have a default size of 1024 bits;
-           RSA keys for use as key signing keys (KSKs, generated with
-           <option>-f KSK</option>) default to 2048 bits.
+           pre-defined defaults.  For instance, RSA keys have a default
+           size of 2048 bits.
          </para>
        </listitem>
       </varlistentry>