DSA KEYs and SIGs in the Domain Name System (DNS)
updated by
- rfc-6944 — Applicability Statement: DNS Security (DNSSEC) DNSKEY Algorithm Implementation Status
Extracted elements (13)
Current DNS implementations are optimized for transfers under 512 bytes; implementors should minimize KEY RR set sizes while maintaining adequate security, since at least one authenticating SIG RR will also be returned in secure zones.
DSA signature verification is an order of magnitude slower than RSA when RSA uses a small public exponent (as recommended for DNS KEY RRs), making RSA preferable for DNS data authentication from a performance standpoint.
T is included in the SIG RR (though not logically necessary) so that values of T > 8 can be used as an escape for extended versions of DSA or other algorithms as later specified.
Implementation of DSA is mandatory for DNS security. DSA public keys are stored using algorithm number 3 in KEY RRs.
DSA signature computation: hash = SHA-1(data), generate random K where 0 < K < Q, R = (G**K mod P) mod Q, S = (K**(-1) * (hash + X*R)) mod Q, following FIPS 186.
Q is a 160-bit prime (2**159 < Q < 2**160) always stored as 20 octets. P is in the range 2**(511+64T) < P < 2**(512+64T), making it 64+8*T octets long. G and Y are quantities modulo P allocated the same fixed size as P.
T is a key size parameter where 0 <= T <= 8, determining the length of P, G, and Y fields. Values of T > 8 are reserved for future extensions of DSA or other algorithms.
Allocation of meaning to values of the T parameter greater than 8 requires IETF standards action. Unallocated values are intended to cover future extensions of the DSS standard.
DSA requires frequent generation of high-quality random numbers. Use of manipulated rather than random numbers enables high-bandwidth covert channels, and the leakage of an entire DSA private key in only two DSA signatures has been demonstrated.
Keys retrieved from DNS must not be trusted unless securely obtained from a secure resolver or independently verified by the user, and the resolver/obtainment method conforms to security policies acceptable to the user.
The maximum DSA key size of 1024 bits (T=8) may limit security for critical applications; implementors are encouraged to consider the range of available algorithms and key sizes.
DSA KEY RR RDATA structure: T (1 octet, key size parameter 0-8), Q (20 octets, prime), P (64+T*8 octets), G (64+T*8 octets), Y (64+T*8 octets). All fields stored in big-endian network order.
DSA SIG RR signature field structure: T (1 octet, copied from public key), R (20 octets), S (20 octets). R and S are the DSA signature components, each at most 20 octets since Q is 160 bits.