RFC 6605
Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC
RFC 6605: Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC 🦋
okay bestie, here's the title block tea ☕ (part 1 of 2 💅)
Internet Engineering Task Force (IETF) · Request for Comments: 6605 · ISSN: 2070-1721 · April 2012
Written by P. Hoffman (VPN Consortium) and W.C.A. Wijngaards (NLnet Labs). It's a Standards Track doc, and the title block doesn't list any RFCs it obsoletes or updates 🙈
Abstract ✨
This doc is all about how to specify Elliptic Curve Digital Signature Algorithm (DSA) keys and signatures in DNS Security (DNSSEC). It lists curves of different sizes and uses the SHA-2 family of hashes for signatures 🔥
Status of This Memo 📜
This is an Internet Standards Track document, so it's officially a big deal 👑
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 5741.
For the current status of this document, any errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc6605.
Copyright Notice ©
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License 🫶
1. Introduction 🌸
okay so DNSSEC is defined broadly in RFCs 4033, 4034, and 4035 ([RFC4033], [RFC4034], and [RFC4035]). It uses cryptographic keys and digital signatures to give authentication of DNS data. Right now, the most popular signature algorithm is RSA with SHA-1, using keys that are 1024 or 2048 bits long 💀
This document defines the DNSKEY and RRSIG resource records (RRs) for two new signing algorithms: ECDSA (Elliptic Curve DSA) with curve P-256 and SHA-256, and ECDSA with curve P-384 and SHA-384. (A description of ECDSA can be found in [FIPS-186-3].) It also defines the DS RR for the SHA-384 one-way hash algorithm. The DS RR for SHA-256 is already defined in RFC 4509 [RFC4509]. [RFC6090] is a good intro to implementing ECDSA ✨
Current estimates say ECDSA with curve P-256 has roughly the same strength as RSA with 3072-bit keys. Using ECDSA with curve P-256 in DNSSEC has some pros and cons compared to RSA with SHA-256 and 3072-bit keys 🦋 ECDSA keys are way shorter than RSA keys. At this size, that's 256 bits versus 3072 bits. ECDSA signatures are also way shorter than RSA signatures. This matters because DNSSEC stores and transmits both keys and signatures 🎀
In the two signing algorithms defined here, the size of the elliptic curve's key matches the size of the hash algorithm's output. This design comes from the widespread belief that the equivalent strength of P-256 and P-384 is half the length of the key, and that the equivalent strength of SHA-256 and SHA-384 is also half the length of the key. Matching the strengths stops an attacker from picking the weaker half of a signature algorithm. For example, in a signature using RSA with 2048-bit keys and SHA-256, the signing part is much weaker than the hash part. The two algorithms here are balanced ⚖️✨
Signing with ECDSA is significantly faster than with RSA (over 20 times in some implementations). But validating RSA signatures is significantly faster than validating ECDSA signatures (about 5 times faster in some implementations). So it's a trade-off 🙈
Some of the material in this document is copied liberally from RFC 6460 [RFC6460].
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 📜💖
2. SHA-384 DS Records 🧚
SHA-384 is defined in FIPS 180-3 [FIPS-180-3] and RFC 6234 [RFC6234], and it's pretty similar to SHA-256 in lots of ways. The SHA-384 implementation in DNSSEC follows the SHA-256 implementation specified in RFC 4509, except that the underlying algorithm is SHA-384, the digest value is 48 bytes long, and the digest type code is 4 🍓
3. ECDSA Parameters 💜
Verifying ECDSA signatures requires the signer and the verifier to agree on the parameters used. FIPS 186-3 [FIPS-186-3] lists some NIST-recommended elliptic curves. (Other documents give more detail on ECDSA than FIPS 186-3 does.) These are the same curves listed in RFC 5114 [RFC5114]. The curves used in this document are:
FIPS 186-3 RFC 5114
------------------------------------------------------------------
P-256 (Section D.1.2.3) 256-bit Random ECP Group (Section 2.6)
P-384 (Section D.1.2.4) 384-bit Random ECP Group (Section 2.7)4. DNSKEY and RRSIG Resource Records for ECDSA 🔥
ECDSA public keys are made of a single value, called "Q" in FIPS 186-3. In DNSSEC keys, Q is a simple bit string that represents the uncompressed form of a curve point, "x | y" 🦋
The ECDSA signature is a pair of non-negative integers, called "r" and "s" in FIPS 186-3. Each integer is formatted as a simple octet string. For DNSSEC, the two are glued together into one longer octet string as the concatenation "r | s". (Converting the integers to bit strings is described in Section C.2 of FIPS 186-3.) For P-256, each integer MUST be encoded as 32 octets. For P-384, each integer MUST be encoded as 48 octets 💅
The algorithm numbers for the DNSKEY and RRSIG resource records are fully defined in the IANA Considerations section. They are:
- DNSKEY and RRSIG RRs signifying ECDSA with the P-256 curve and SHA-256 use the algorithm number 13.
- DNSKEY and RRSIG RRs signifying ECDSA with the P-384 curve and SHA-384 use the algorithm number 14.
Conformant implementations that create records to be put into the DNS MUST implement signing and verification for both of the above algorithms. Conformant DNSSEC verifiers MUST implement verification for both of the above algorithms 🫶
5. Support for NSEC3 Denial of Existence 🌈
RFC 5155 [RFC5155] defines new algorithm identifiers for existing signing algorithms. These show that zones signed with these identifiers can use NSEC3 as well as NSEC records to provide denial of existence. That mechanism was picked to protect implementations that predate RFC 5155 from running into resource records they couldn't know about. This document does not define such algorithm aliases 🙈
A DNSSEC validator that implements the signing algorithms defined in this document MUST be able to validate negative answers in the form of both NSEC and NSEC3 with hash algorithm 1, as defined in RFC 5155. An authoritative server that does not implement NSEC3 MAY still serve zones that use the signing algorithms defined in this document with NSEC denial of existence ✨
6. Examples 🎀
Here are some examples of ECDSA keys and signatures in DNS format 🧁
6.1. P-256 Example
Private-key-format: v1.2
Algorithm: 13 (ECDSAP256SHA256)
PrivateKey: GU6SnQ/Ou+xC5RumuIUIuJZteXT2z0O/ok1s38Et6mQ=
example.net. 3600 IN DNSKEY 257 3 13 (
GojIhhXUN/u4v54ZQqGSnyhWJwaubCvTmeexv7bR6edb
krSqQpF64cYbcB7wNcP+e+MAnLr+Wi9xMWyQLc8NAA== )
example.net. 3600 IN DS 55648 13 2 (
b4c8c1fe2e7477127b27115656ad6256f424625bf5c1
e2770ce6d6e37df61d17 )
www.example.net. 3600 IN A 192.0.2.1
www.example.net. 3600 IN RRSIG A 13 3 3600 (
20100909100439 20100812100439 55648 example.net.
qx6wLYqmh+l9oCKTN6qIc+bw6ya+KJ8oMz0YP107epXA
yGmt+3SNruPFKG7tZoLBLlUzGGus7ZwmwWep666VCw== )6.2. P-384 Example
Private-key-format: v1.2
Algorithm: 14 (ECDSAP384SHA384)
PrivateKey: WURgWHCcYIYUPWgeLmiPY2DJJk02vgrmTfitxgqcL4vw
W7BOrbawVmVe0d9V94SR
example.net. 3600 IN DNSKEY 257 3 14 (
xKYaNhWdGOfJ+nPrL8/arkwf2EY3MDJ+SErKivBVSum1
w/egsXvSADtNJhyem5RCOpgQ6K8X1DRSEkrbYQ+OB+v8
/uX45NBwY8rp65F6Glur8I/mlVNgF6W/qTI37m40 )
example.net. 3600 IN DS 10771 14 4 (
72d7b62976ce06438e9c0bf319013cf801f09ecc84b8
d7e9495f27e305c6a9b0563a9b5f4d288405c3008a94
6df983d6 )
www.example.net. 3600 IN A 192.0.2.1
www.example.net. 3600 IN RRSIG A 14 3 3600 (
20100909102025 20100812102025 10771 example.net.
/L5hDKIvGDyI1fcARX3z65qrmPsVz73QD1Mr5CEqOiLP
95hxQouuroGCeZOvzFaxsT8Glr74hbavRKayJNuydCuz
WTSSPdz7wnqXL5bdcJzusdnI0RSMROxxwGipWcJm )9.1. Normative References ✨
These are the must-reads, bestie 📚 Everything here is what the spec leans on, so the details matter.
- [FIPS-180-3] National Institute of Standards and Technology, U.S. Department of Commerce, "Secure Hash Standard (SHS)", FIPS 180-3, October 2008. 🔐
- [FIPS-186-3] National Institute of Standards and Technology, U.S. Department of Commerce, "Digital Signature Standard", FIPS 186-3, June 2009. ✍️
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. 💖
- [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "DNS Security Introduction and Requirements", RFC 4033, March 2005. 🌸
- [RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Resource Records for the DNS Security Extensions", RFC 4034, March 2005. 🧚
- [RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Protocol Modifications for the DNS Security Extensions", RFC 4035, March 2005. 🦋
- [RFC4509] Hardaker, W., "Use of SHA-256 in DNSSEC Delegation Signer (DS) Resource Records (RRs)", RFC 4509, May 2006. 🎀
- [RFC5114] Lepinski, M. and S. Kent, "Additional Diffie-Hellman Groups for Use with IETF Standards", RFC 5114, January 2008. 🌈
- [RFC5155] Laurie, B., Sisson, G., Arends, R., and D. Blacka, "DNS Security (DNSSEC) Hashed Authenticated Denial of Existence", RFC 5155, March 2008. 🙈
9.2. Informative References
These ones are bonus reading, iykyk 💅
- [RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic Curve Cryptography Algorithms", RFC 6090, February 2011. ⭐
- [RFC6234] Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)", RFC 6234, May 2011. 🍓
- [RFC6460] Salter, M. and R. Housley, "Suite B Profile for Transport Layer Security (TLS)", RFC 6460, January 2012. 👑
Authors' Addresses ✨
Paul Hoffman VPN Consortium
EMail: paul.hoffman@vpnc.org
Wouter C.A. Wijngaards NLnet Labs
EMail: wouter@nlnetlabs.nl
And that's the whole thing, bestie 🫶💜
📦 where this page comes from
- ietf: rfc6605 2012-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms