RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)
obsoletes
- rfc-2537 — RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)
updated by
- rfc-6944 — Applicability Statement: DNS Security (DNSSEC) DNSKEY Algorithm Implementation Status
Extracted elements (15)
A public exponent of 3 minimizes signature verification effort, making it acceptable for DNSSEC authentication-only use. However, 65537 (F4) is recommended for keys that may also be used for confidentiality, since exponent-3 keys are vulnerable to Chinese Remainder Theorem attacks when the same data is encrypted under three such keys.
MD5 was replaced by SHA1 because continued cryptographic research revealed hints of weakness in MD5. SHA1 produces a larger hash and is generally acknowledged to be stronger, making it appropriate for high-value DNS zones such as root and top-level domains.
RSA signature verification is an order of magnitude faster than DSA when a small public exponent is used, making RSA preferable for DNS data authentication where verifiers significantly outnumber signers.
The SHA1 prefix (ASN.1 BER algorithm designator) is included in the signature structure to make it easier to use standard cryptographic libraries that expect PKCS1-formatted input.
RFC 3110 completely obsoletes RFC 2537. The algorithm number for RSA KEY RRs is changed from the RFC 2537 value to algorithm number 5, which is also used for RSA/SHA1 SIG RRs. Implementations must use the new algorithm number.
For interoperability, the exponent and modulus are each limited to 4096 bits in length. Leading zero octets are prohibited in the exponent and modulus.
Implementation of the RSA algorithm in DNS with SHA1 is MANDATORY for DNSSEC. The generation of RSA/MD5 SIG RRs as described in RFC 2537 is NOT RECOMMENDED.
KEY RRs for use with RSA/SHA1 DNS signatures MUST use algorithm number 5 rather than the algorithm number specified in the obsoleted RFC 2537.
The FF octet in the RSA/SHA1 signature padding MUST be repeated the maximum number of times such that the value being exponentiated is one octet shorter than the value of n.
The size of n MUST be not less than 512 bits and not more than 4096 bits. n and e SHOULD be chosen such that the public exponent is small.
RSA public keys are stored in the DNS as KEY RRs using algorithm number 5. RSA/SHA1 signatures are stored using SIG RRs also with algorithm number 5, aligning the key and signature algorithm numbers.
DNSSEC algorithm number 5 is allocated for RSA/SHA1 SIG RRs and RSA KEY RRs, replacing the previously used algorithm number from RFC 2537.
Keys retrieved from the DNS should not be trusted unless (1) securely obtained from a secure resolver or independently verified by the user and (2) the secure resolver and obtainment conform to security policies acceptable to the user. Evaluating key strength is essential and dependent on local policy.
RSA public KEY RR RDATA contains three fields: exponent length (1 or 3 octets), exponent (variable), and modulus (remaining space). The exponent length is one octet if 1–255, or a zero octet followed by a two-octet unsigned length if longer than 255 bytes.
The RSA/SHA1 SIG RR signature is computed as: hash = SHA1(data); signature = (01 | FF* | 00 | prefix | hash) ** e (mod n), where prefix is the ASN.1 BER SHA1 algorithm designator hex 30 21 30 09 06 05 2B 0E 03 02 1A 05 00 04 14.