RFC 2537

RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)

📅 published March 1999, from ietf

RFC 2537 🎀✨

  • RFC number: 2537
  • Title: RSA/MD5 KEYs and SIGs in the Domain Name System (DNS) 💅
  • Authors: D. Eastlake (Donald E. Eastlake 3rd), IBM 🦋
  • Category: Standards Track
  • Date: March 1999
  • Obsoletes / Updates: this RFC's header doesn't list either one 🌸

Status of This Memo ✨

okay so this doc is an Internet standards track protocol for the whole Internet community 🌈 it's asking people for discussion and suggestions to make it better, bestie 🫶 if you want the current standardization state and status of this protocol, go check the current edition of "Internet Official Protocol Standards" (STD 1). and distribution of this memo is unlimited, so share away 💖

Copyright (C) The Internet Society (1999). All Rights Reserved. 💜

Abstract 🌸

this one describes a standard way to store RSA keys and RSA/MD5 based signatures in the Domain Name System, using DNS KEY and SIG resource records. it's giving secure key storage in DNS, obsessed 😭

Table of Contents 🧚

Abstract...................................................1
1. Introduction............................................1
2. RSA Public KEY Resource Records.........................2
3. RSA/MD5 SIG Resource Records............................2
4. Performance Considerations..............................3
5. Security Considerations.................................4
References.................................................4
Author's Address...........................................5
Full Copyright Statement...................................6

1. Introduction ✨

okay bestie, so the Domain Name System (DNS) is the global, hierarchical, replicated, distributed database system for Internet addressing, mail proxy, and other info 🍓 it's been extended to include digital signatures and cryptographic keys, as described in [RFC 2535] 🔐 so now the DNS can be secured and used for secure key distribution. slay 👑

this doc tells you how to store RSA keys and RSA/MD5 based signatures in the DNS 💅 it assumes you already know the RSA algorithm [Schneier] 📚 and implementing the RSA algorithm in DNS is recommended 🦋

the key words "MUST", "REQUIRED", "SHOULD", "RECOMMENDED", and "MAY" in this document are to be interpreted as described in RFC 2119 ⭐

2. RSA Public KEY Resource Records 🎀

RSA public keys get stored in the DNS as KEY RRs using algorithm number 1 [RFC 2535] 💖 the algorithm-specific part of the RDATA for these RRs looks like this:

        Field             Size
        -----             ----
        exponent length   1 or 3 octets (see text)
        exponent          as specified by length field
        modulus           remaining space

for interoperability, the exponent and modulus are each currently limited to 4096 bits in length 🫶 the public key exponent is a variable length unsigned integer. its length in octets is one octet if it's in the range of 1 to 255. if it's longer than 255 bytes, you get a zero octet followed by a two octet unsigned length instead 🧚 the public key modulus field is a multiprecision unsigned integer. you can figure out the modulus length from RDLENGTH and the RDATA fields before it, including the exponent 🦋 and leading zero octets are prohibited in the exponent and modulus, no cap 🙈

3. RSA/MD5 SIG Resource Records 🌈

when you use the RSA/MD5 algorithm, the signature part of the SIG RR RDATA gets calculated like this. the data that gets signed is determined as specified in [RFC 2535], and the SIG RR RDATA fields that come before the signature are also covered there 🔥

hash = MD5 ( data )

signature = ( 00 | 01 | FF* | 00 | prefix | hash ) ** e (mod n)

here MD5 is the message digest algorithm documented in [RFC 1321]. "|" means concatenation, "e" is the private key exponent of the signer, and "n" is the modulus of the signer's public key 💜 the octets 01, FF, and 00 are fixed, each with the matching hexadecimal value. "prefix" is the ASN.1 BER MD5 algorithm designator prefix from [RFC 2437], which is:

  hex 3020300c06082a864886f70d020505000410 [NETSEC].

this prefix is included so it's easier to use RSAREF (or similar packages, like EuroRef) 🍓 the FF octet MUST be repeated the maximum number of times so the quantity being exponentiated is the same length in octets as n 👑

(all of the above is identical to the matching part of Public Key Cryptographic Standard #1 [RFC 2437] 🌸)

the size of n, counting the most and least significant bits (which will be 1), MUST be not less than 512 bits and not more than 4096 bits ✨ and n and e SHOULD be chosen so the public exponent is small 🦋

leading zero bytes are permitted in the RSA/MD5 algorithm signature 🫶

ngl, a public exponent of 3 makes verifying a signature take the least effort 💅 but using 3 as the public exponent is weak for confidentiality. if the same data gets collected encrypted under three different keys with an exponent of 3, then the Chinese Remainder Theorem [NETSEC] lets you easily recover the original plaintext 😭 this weakness isn't a big deal for DNS security, because the goal here is only authentication, not confidentiality 💖

4. Performance Considerations 💅

general signature generation speeds are roughly the same for RSA and DSA [RFC 2536] 🦋 with enough pre-computation, signature generation with DSA is faster than RSA, and key generation is faster for DSA too 🔥 but signature verification is an order of magnitude slower with DSA when the RSA public exponent is small, which is what's recommended for KEY RRs used in DNS data authentication 🙈

current DNS implementations are tuned for small transfers, typically under 512 bytes including overhead 🌸 bigger transfers will still work correctly, and work is underway to make them more efficient. still, it's advisable right now to make reasonable efforts to keep KEY RR sets small in the DNS while keeping adequate security 🧚 and remember that in a secure zone, at least one authenticating SIG RR will also come back with them 💜

5. Security Considerations 🔐

tons of the general security considerations in [RFC 2535] apply here ✨ keys pulled from the DNS should not be trusted unless (1) they were securely obtained from a secure resolver or independently verified by the user, and (2) that secure resolver and secure obtainment or independent verification match security policies the user finds acceptable 💀 as with all cryptographic algorithms, figuring out how strong your key needs to be is essential and depends on local policy 🫶

for interoperability, the RSA key size is limited to 4096 bits 🎀 for really critical applications, implementers are encouraged to think about the range of available algorithms and key sizes 👑

References 📚

  • [NETSEC] Kaufman, C., Perlman, R. and M. Speciner, "Network Security: PRIVATE Communications in a PUBLIC World", Series in Computer Networking and Distributed Communications, 1995.
  • [RFC 2437] Kaliski, B. and J. Staddon, "PKCS #1: RSA Cryptography Specifications Version 2.0", RFC 2437, October 1998.
  • [RFC 1034] Mockapetris, P., "Domain Names - Concepts and Facilities", STD 13, RFC 1034, November 1987.
  • [RFC 1035] Mockapetris, P., "Domain Names - Implementation and Specification", STD 13, RFC 1035, November 1987.
  • [RFC 1321] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, April 1992.
  • [RFC 2535] Eastlake, D., "Domain Name System Security Extensions", RFC 2535, March 1999.
  • [RFC 2536] EastLake, D., "DSA KEYs and SIGs in the Domain Name System (DNS)", RFC 2536, March 1999.
  • [Schneier] Bruce Schneier, "Applied Cryptography Second Edition: protocols, algorithms, and source code in C", 1996, John Wiley and Sons, ISBN 0-471-11709-9.

Author's Address 🦋

Donald E. Eastlake 3rd
IBM
65 Shindegan Hill Road, RR #1
Carmel, NY 10512

Phone:   +1-914-276-2668(h)
         +1-914-784-7913(w)
Fax:     +1-914-784-3833(w)
EMail:   dee3@us.ibm.com

Copyright (C) The Internet Society (1999). All Rights Reserved. 🌈

this document, and translations of it, may be copied and handed out to others. derivative works that comment on or explain it, or help with implementing it, may be prepared, copied, published and distributed, in whole or in part, with no restrictions, as long as the copyright notice and this paragraph are included on every copy and derivative work 💖 but this document itself may not be modified in any way, like removing the copyright notice or the references to the Internet Society or other Internet organizations. the exception is when it's needed for developing Internet standards, in which case the Internet Standards process copyright procedures must be followed, or when translating it into languages other than English 🫶

the limited permissions above are perpetual and won't be revoked by the Internet Society or its successors or assigns ✨

this document and the information in it are provided on an "AS IS" basis, and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED. that includes, but isn't limited to, any warranty that using the information here won't infringe any rights, and any implied warranties of merchantability or fitness for a particular purpose 💀

📦 where this page comes from