Subject: Is there already an implementation of RSA-SHA2 for DNSSEC?

From: Yue Luo <[email-masked]>
Date: Thu, 20 Mar 2008 13:00:41 -0700

I am wondering if anyone knows a DNS server that has already implemented RSA-SHA2 as specified in draft-ietf-dnsext-dnssec-rsasha256-03.

Thank you.
Yue

---

From: Jelte Jansen <[email-masked]>
Date: Fri, 21 Mar 2008 00:14:17 +0100

> I am wondering if anyone knows a DNS server that has already implemented RSA-SHA2 as specified in draft-ietf-dnsext-dnssec-rsasha256-03.

Actually, servers themselves shouldn't need any special modifications to
support the SHA-2 algorithms, as long as they don't do any weird
in-depth processing of RDATA fields (like, check for known algorithms).

What one does need to play with SHA2 keys and signatures is a zone
signer that implements it. I have added preliminary support for it in
the current trunk of ldns (which manifests itself in ldns-keygen,
ldns-signzone and drill), as long as it's compiled with a version of
OpenSSL that supports the SHA2 family of functions.

Contact me off-list if you want a pointer to the trunk version, or if
you have problems with or suggestions about it. The usual disclaimer
about unreleased development code is applicable.

Of course, since there are no assigned algorithm identifiers from IANA
yet, we had to make them up. These are highly likely to change, if not
only because the separate NSEC3 numbers will be removed from -04 (when
text will be added to the lines of 'if you understand SHA2, you
understand NSEC3', which will remove the need to use separate algorithm
identifiers).

Jelte

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>