RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)
obsoleted by
- rfc-3110 — RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)
Extracted elements (15)
A public exponent of 3 minimizes the effort needed to verify a signature. Although exponent 3 is weak for confidentiality (vulnerable to Chinese Remainder Theorem attacks when the same data is encrypted under three keys), this weakness is not significant for DNS security because only authentication, not confidentiality, is sought.
Current DNS implementations are optimized for small transfers (typically less than 512 bytes including overhead), so implementors should make reasonable efforts to minimize KEY RR set sizes while maintaining adequate security.
Signature verification is an order of magnitude slower with DSA than RSA when the RSA public exponent is small, making RSA preferable for DNS data authentication where verification speed is critical.
The ASN.1 BER MD5 algorithm designator prefix is included in the signature to make it easier to use RSAREF and similar packages such as EuroRef, and the specification is identical to PKCS #1 (RFC 2437).
Leading zero bytes are permitted in the RSA/MD5 algorithm signature (in contrast to the prohibition on leading zeros in the KEY RR exponent and modulus fields).
For interoperability, the exponent and modulus are each currently limited to 4096 bits in length.
Leading zero octets are prohibited in the exponent and modulus fields of the RSA public KEY resource record.
The FF octet MUST be repeated the maximum number of times such that the value of the quantity being exponentiated is the same length in octets as the value of n (the modulus).
The public key modulus n and exponent e SHOULD be chosen such that the public exponent is small, to optimize signature verification performance in DNS.
The size of n (the RSA modulus), including most and least significant bits, MUST be not less than 512 bits and not more than 4096 bits.
RSA public keys are stored in the DNS as KEY RRs using algorithm number 1. The RDATA structure contains an exponent length field (1 or 3 octets), a variable-length exponent, and the modulus occupying remaining space.
The RSA/MD5 SIG RR signature is computed as: hash = MD5(data), then signature = (00 | 01 | FF* | 00 | prefix | hash) ** e (mod n), where prefix is the ASN.1 BER MD5 algorithm designator (hex 3020300c06082a864886f70d020505000410).
For particularly critical applications, implementors are encouraged to consider the range of available algorithms and key sizes, as the 4096-bit RSA key size limit is set for interoperability rather than maximum security.
Keys retrieved from the DNS should not be trusted unless they have been securely obtained from a secure resolver or independently verified by the user, and the resolver and obtainment method conform to security policies acceptable to the user.
The exponent length field is 1 octet if the exponent is 1-255 bytes long; if longer than 255 bytes, a zero octet followed by a 2-octet unsigned length is used. The modulus length is derived from RDLENGTH minus preceding RDATA fields.