DNST KEYSET doesn't work correctly for ED448 (algorithm 16)

[ldc77shirt]

It seems like dnst keyset generate in a wrong way the private key and the public key with ED448 when i add a zone.
I report the output

LDC@UBUNTU-PJW:/var/lib/cascade$ cascade zone add --source /var/lib/cascade/zone-cust/bug16.txt --policy prova8 test.it
2026-01-14T21:06:47.959752Z DEBUG cascade::cli::client: Sending HTTP POST request to 'http://127.0.0.1:4539/zone/add'
2026-01-14T21:06:47.959977Z DEBUG reqwest::connect: starting new connection: http://127.0.0.1:4539/
2026-01-14T21:06:47.960009Z DEBUG hyper_util::client::legacy::connect::http: connecting to 127.0.0.1:4539
2026-01-14T21:06:47.960126Z DEBUG hyper_util::client::legacy::connect::http: connected to 127.0.0.1:4539
2026-01-14T21:06:48.101142Z DEBUG hyper_util::client::legacy::pool: pooling idle connection for ("http", 127.0.0.1:4539)
2026-01-14T21:06:48.101424Z ERROR cascade: Error: Failed to add zone: Zone registration failed: Keyset command '/usr/libexec/cascade/cascade-dnst keyset -c /var/lib/cascade/keys/test.it.cfg init' returned non-zero exit code: exit status: 1 [stdout=, stderr=[/usr/libexec/cascade/cascade-dnst] ERROR: private key file:///var/lib/cascade/keys/Ktest.it.+016+03487.private and public key file:///var/lib/cascade/keys/Ktest.it.+016+03487.key do not match: algorithm not supported

]

These are the KSK keys

test.it. IN DNSKEY 257 3 16
a/IZyl8Zqd9EZyxLTiK1J4d5GCCscmM8PRjjVHaiRyGLny8DO4ijdWE74YPuEv5GaHRk8emM+bUA

Private-key-format: v1.2
Algorithm: 16 (ED448)
PrivateKey: 5b6nQJmHioFNxyC2AkaVXG8atzjZ/N0XN4s33/PeWKpNoR/UE1PaSyf7dVTcs1y5sj6cHQUbYf97

These are the ZSK keys

test.it. IN DNSKEY 256 3 16
cn1/nAHRnjROdO4luBsr13rLU87q8n1DkIYFG37uTYwQbOpl5csM7TCN5YTxgvqlSujNSKO2F8wA

Private-key-format: v1.2
Algorithm: 16 (ED448)
PrivateKey: 0yWaTVbgqhxRdSr4FDnY+Loh0oRq8SjoB4VsPxm9G2JU9oieV/E43ZF4CzWDid0OLZMw/LdrrOsH

[Philip-NLnetLabs]

I can confirm that I get the same error. I'll investigate what is wrong.

[Philip-NLnetLabs]

It turned out to be a problem in Domain. I created a PR there: NLnetLabs/domain#608

[Philip-NLnetLabs]

The PR in domain has been merged.

[ximon18]

@ldc77shirt,

I believe this is fixed on current main:

$ target/release/cascaded -V
cascade 0.1.0-alpha5 at f8fb8a0a45

$ dig @127.0.0.1 -p 2005 AXFR example.com.

; <<>> DiG 9.18.44 <<>> @127.0.0.1 -p 2005 AXFR example.com.
; (1 server found)
;; global options: +cmd
example.com.            2000    IN      SOA     ns.example.com. some\.bloke.example.com. 2026032700 86400 3500 3212 22
example.com.            22      IN      NSEC    example.com. A SOA RRSIG NSEC DNSKEY
example.com.            3600    IN      DNSKEY  257 3 16 L4o0odWpvbqU/lF5T/ALGlW/O1/ZyA2PRrvfeYDFc6rFrOphRT31h9VO HFAav/9kre+WBw+JK2kA

As you can see that signed output uses algorithm 16 which is ED448.

Would you like to re-test or should I just close this issue?

Ximon