Storage of Diffie-Hellman Keys in the Domain Name System (DNS)
updated by
- rfc-6944 — Applicability Statement: DNS Security (DNSSEC) DNSKEY Algorithm Implementation Status
Extracted elements (14)
No Diffie-Hellman algorithm SIG RR is defined because DH requires two parties to interact to derive keying material, whereas DNS SIG RRs are primarily used as stored authenticators of zone information for many different resolvers — an inherently one-to-many relationship incompatible with DH's interactive nature.
The well-known prime/generator pairs (Groups 1 and 2) are copied from the IPsec effort, where their derivation is more fully explained. Using an index rather than repeating the full prime saves significant space in DNS responses.
Current DNS implementations are optimized for transfers typically under 512 bytes including overhead. Implementors should make reasonable efforts to minimize KEY RR set sizes consistent with adequate security, since a secure zone also returns an authenticating SIG RR alongside each KEY RR.
Private well-known pair indices (0xC000–0xFFFF) are not centrally coordinated; use of such private pairs outside of a closed environment may result in conflicts with other deployments using the same index values.
When the prime length field is 1 or 2 (indicating an index into the well-known prime/generator table), the generator length field SHOULD be zero, as the generator is implied by the indexed pair.
Diffie-Hellman keys are stored in the DNS as KEY RRs using algorithm number 2. The first 4 octets (flags, protocol, algorithm) are common to all KEY RRs as described in RFC 2535; the remainder encodes the DH public key parameters.
The prime length field encodes the length of the DH prime in bytes when the value is 16 or greater. If the value is 1 or 2, the prime field is instead an unsigned index into a table of up to 65,536 well-known prime/generator pairs. Values of 0 and 3 through 15 are reserved.
Well-Known Group 1 is a 768-bit prime defined as 2^768 - 2^704 - 1 + 2^64 * {[2^638 pi] + 149686} with generator 2, assigned index 0x0001. Its hex representation is given in Appendix A.1.
Well-Known Group 2 is a 1024-bit prime defined as 2^1024 - 2^960 - 1 + 2^64 * {[2^894 pi] + 129093} with generator 2, assigned index 0x0002. Its hex representation is given in Appendix A.2.
Assignment of meaning to prime length values 0 and 3 through 15 in the DH KEY RR requires IETF consensus; these values are currently reserved.
RFC 2539 defines a registry of well-known Diffie-Hellman prime/generator pairs indexed by a 16-bit value. Pairs 0x0000–0x07FF require IETF standards action; 0x0800–0xBFFF require RFC documentation; 0xC000–0xFFFF are available for private use and not centrally coordinated.
Keys retrieved from the DNS MUST NOT be trusted unless (1) securely obtained from a secure resolver or independently verified by the user, and (2) that secure resolver and verification method conform to security policies acceptable to the user. As with all cryptographic algorithms, evaluating necessary key strength is important and dependent on local policy.
Standard Diffie-Hellman key strength requirements apply: (p-1)/2 should also be prime, g should be primitive mod p, and p should be 'large.' Failure to select strong parameters allows discrete logarithm attacks that would expose the shared secret.
The RDATA of a DH KEY RR contains: a 2-octet prime length (or flag), a variable-length prime (p) in network byte order, a 2-octet generator length, a variable-length generator (g) in network byte order, a 2-octet public value length, and the variable-length public value (g^i mod p) in network byte order.