Use of SHA-2 Algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC
updated by
- rfc-6944 — Applicability Statement: DNS Security (DNSSEC) DNSKEY Algorithm Implementation Status
Extracted elements (16)
RSASSA-PKCS1-v1_5 was chosen as the signature scheme to match the one used for RSA/SHA-1 signatures, easing implementation of new hashing algorithms in existing DNSSEC software.
This document does not define NSEC3 algorithm aliases for RSA/SHA-2 (unlike RFC 5155 for older algorithms) because that aliasing mechanism was specifically designed to protect pre-RFC 5155 implementations, which would not exist for newly defined algorithm numbers.
RRSIG records produced with RSA/SHA-256 or RSA/SHA-512 will have the same size as those produced with RSA/SHA-1, if the keys have the same length, because signature size depends on key size rather than the hash algorithm.
A DNSSEC validator that implements RSA/SHA-2 MUST be able to validate negative answers in the form of both NSEC and NSEC3 with hash algorithm 1, as defined in RFC 5155.
An authoritative server that does not implement NSEC3 MAY still serve zones that use RSA/SHA-2 with NSEC denial of existence.
DNSSEC-aware implementations SHOULD be able to support RRSIG and DNSKEY resource records created with the RSA/SHA-2 algorithms as defined in this document.
For RSA/SHA-256 DNSKEY records, the key size MUST NOT be less than 512 bits and MUST NOT be more than 4096 bits, following the interoperability constraint established in RFC 3110.
For RSA/SHA-512 DNSKEY records, the key size MUST NOT be less than 1024 bits and MUST NOT be more than 4096 bits.
RSA/SHA-256 public keys are stored in DNSKEY RRs with algorithm number 8 (mnemonic: RSASHA256). This algorithm supports zone signing; transaction security standardization is undetermined.
RSA/SHA-512 public keys are stored in DNSKEY RRs with algorithm number 10 (mnemonic: RSASHA512). This algorithm supports zone signing; transaction security standardization is undetermined.
This document adds two entries to the IANA 'DNS SECURITY ALGORITHM NUMBERS' registry: value 8 (RSASHA256, zone signing Y) and value 10 (RSASHA512, zone signing Y), both referencing RFC 5702. Transaction security use is not standardized.
Since each RRSet MUST be signed with each algorithm present in the DNSKEY RRSet at the zone apex (per RFC 4035 Section 2.2), a malicious party cannot filter out RSA/SHA-2 RRSIG records to force use of RSA/SHA-1, providing resilience against algorithm downgrade attacks when validators support RSA/SHA-2.
Users of DNSSEC are encouraged to deploy SHA-2 as soon as software implementations allow. SHA-2 is considered more resilient to attack than SHA-1, whose strength has been eroded by announced attacks, making SHA-2 the better choice for DNSSEC records.
The ASN.1 DER SHA-256 algorithm designator prefix used in RSA/SHA-256 RRSIG records is: hex 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20.
The ASN.1 DER SHA-512 algorithm designator prefix used in RSA/SHA-512 RRSIG records is: hex 30 51 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 04 40.
The RRSIG signature field for RSA/SHA-2 uses RSASSA-PKCS1-v1_5: the padded structure is (00 | 01 | FF* | 00 | prefix | hash) raised to the private exponent mod n. The FF octet is repeated until the total length equals the modulus length.