[−][src]Struct trust_dns_client::rr::rdata::dnskey::DNSKEY
RFC 4034, DNSSEC Resource Records, March 2005
2. The DNSKEY Resource Record
DNSSEC uses public key cryptography to sign and authenticate DNS
resource record sets (RRsets). The public keys are stored in DNSKEY
resource records and are used in the DNSSEC authentication process
described in [RFC4035]: A zone signs its authoritative RRsets by
using a private key and stores the corresponding public key in a
DNSKEY RR. A resolver can then use the public key to validate
signatures covering the RRsets in the zone, and thus to authenticate
them.
The DNSKEY RR is not intended as a record for storing arbitrary
public keys and MUST NOT be used to store certificates or public keys
that do not directly relate to the DNS infrastructure.
The Type value for the DNSKEY RR type is 48.
The DNSKEY RR is class independent.
The DNSKEY RR has no special TTL requirements.
2.1. DNSKEY RDATA Wire Format
The RDATA for a DNSKEY RR consists of a 2 octet Flags Field, a 1
octet Protocol Field, a 1 octet Algorithm Field, and the Public Key
Field.
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Flags | Protocol | Algorithm |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ /
/ Public Key /
/ /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2.1.5. Notes on DNSKEY RDATA Design
Although the Protocol Field always has value 3, it is retained for
backward compatibility with early versions of the KEY record.
Methods
impl DNSKEY
[src]
pub fn new(
zone_key: bool,
secure_entry_point: bool,
revoke: bool,
algorithm: Algorithm,
public_key: Vec<u8>
) -> DNSKEY
[src]
zone_key: bool,
secure_entry_point: bool,
revoke: bool,
algorithm: Algorithm,
public_key: Vec<u8>
) -> DNSKEY
Construct a new DNSKey RData
Arguments
zone_key
- this key is used to sign Zone resource recordssecure_entry_point
- this key is used to sign DNSKeys that sign the Zone recordsrevoke
- this key has been revokedalgorithm
- specifies the algorithm which this Key uses to sign recordspublic_key
- the public key material, in native endian, the emitter will perform any necessary conversion
Return
A new DNSKEY RData for use in a Resource Record
pub fn zone_key(&self) -> bool
[src]
RFC 4034, DNSSEC Resource Records, March 2005
2.1.1. The Flags Field
Bit 7 of the Flags field is the Zone Key flag. If bit 7 has value 1,
then the DNSKEY record holds a DNS zone key, and the DNSKEY RR's
owner name MUST be the name of a zone. If bit 7 has value 0, then
the DNSKEY record holds some other type of DNS public key and MUST
NOT be used to verify RRSIGs that cover RRsets.
Bits 0-6 and 8-14 are reserved: these bits MUST have value 0 upon
creation of the DNSKEY RR and MUST be ignored upon receipt.
pub fn secure_entry_point(&self) -> bool
[src]
RFC 4034, DNSSEC Resource Records, March 2005
2.1.1. The Flags Field
Bit 15 of the Flags field is the Secure Entry Point flag, described
in [RFC3757]. If bit 15 has value 1, then the DNSKEY record holds a
key intended for use as a secure entry point. This flag is only
intended to be a hint to zone signing or debugging software as to the
intended use of this DNSKEY record; validators MUST NOT alter their
behavior during the signature validation process in any way based on
the setting of this bit. This also means that a DNSKEY RR with the
SEP bit set would also need the Zone Key flag set in order to be able
to generate signatures legally. A DNSKEY RR with the SEP set and the
Zone Key flag not set MUST NOT be used to verify RRSIGs that cover
RRsets.
pub fn revoke(&self) -> bool
[src]
RFC 5011, Trust Anchor Update, September 2007
RFC 5011 Trust Anchor Update September 2007
7. IANA Considerations
The IANA has assigned a bit in the DNSKEY flags field (see Section 7
of [RFC4034]) for the REVOKE bit (8).
pub fn algorithm(&self) -> Algorithm
[src]
RFC 4034, DNSSEC Resource Records, March 2005
2.1.3. The Algorithm Field
The Algorithm field identifies the public key's cryptographic
algorithm and determines the format of the Public Key field. A list
of DNSSEC algorithm types can be found in Appendix A.1
pub fn public_key(&self) -> &[u8]
[src]
RFC 4034, DNSSEC Resource Records, March 2005
2.1.4. The Public Key Field
The Public Key Field holds the public key material. The format
depends on the algorithm of the key being stored and is described in
separate documents.
pub fn to_digest(&self, &Name, DigestType) -> Result<Digest, ProtoError>
[src]
This will always return an error unless the Ring or OpenSSL features are enabled
pub fn calculate_key_tag(&self) -> Result<u16, ProtoError>
[src]
The key tag is calculated as a hash to more quickly lookup a DNSKEY.
RFC 1035, DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION, November 1987
RFC 2535 DNS Security Extensions March 1999
4.1.6 Key Tag Field
The "key Tag" is a two octet quantity that is used to efficiently
select between multiple keys which may be applicable and thus check
that a public key about to be used for the computationally expensive
effort to check the signature is possibly valid. For algorithm 1
(MD5/RSA) as defined in [RFC 2537], it is the next to the bottom two
octets of the public key modulus needed to decode the signature
field. That is to say, the most significant 16 of the least
significant 24 bits of the modulus in network (big endian) order. For
all other algorithms, including private algorithms, it is calculated
as a simple checksum of the KEY RR as described in Appendix C.
Appendix C: Key Tag Calculation
The key tag field in the SIG RR is just a means of more efficiently
selecting the correct KEY RR to use when there is more than one KEY
RR candidate available, for example, in verifying a signature. It is
possible for more than one candidate key to have the same tag, in
which case each must be tried until one works or all fail. The
following reference implementation of how to calculate the Key Tag,
for all algorithms other than algorithm 1, is in ANSI C. It is coded
for clarity, not efficiency. (See section 4.1.6 for how to determine
the Key Tag of an algorithm 1 key.)
/* assumes int is at least 16 bits
first byte of the key tag is the most significant byte of return
value
second byte of the key tag is the least significant byte of
return value
*/
int keytag (
unsigned char key[], /* the RDATA part of the KEY RR */
unsigned int keysize, /* the RDLENGTH */
)
{
long int ac; /* assumed to be 32 bits or larger */
for ( ac = 0, i = 0; i < keysize; ++i )
ac += (i&1) ? key[i] : key[i]<<8;
ac += (ac>>16) & 0xFFFF;
return ac & 0xFFFF;
}
pub fn calculate_key_tag_internal(bytes: &[u8]) -> u16
[src]
Internal checksum function (used for non-RSAMD5 hashes only, however, RSAMD5 is considered deprecated and not implemented in trust-dns, anyways).
Trait Implementations
impl Clone for DNSKEY
[src]
impl Debug for DNSKEY
[src]
impl Eq for DNSKEY
[src]
impl From<DNSKEY> for RData
[src]
impl Hash for DNSKEY
[src]
fn hash<__H>(&self, state: &mut __H) where
__H: Hasher,
[src]
__H: Hasher,
fn hash_slice<H>(data: &[Self], state: &mut H) where
H: Hasher,
1.3.0[src]
H: Hasher,
impl PartialEq<DNSKEY> for DNSKEY
[src]
impl StructuralEq for DNSKEY
[src]
impl StructuralPartialEq for DNSKEY
[src]
impl Verifier for DNSKEY
[src]
fn algorithm(&self) -> Algorithm
[src]
fn key(&'k self) -> Result<PublicKeyEnum<'k>, ProtoError>
[src]
fn verify(&self, hash: &[u8], signature: &[u8]) -> Result<(), ProtoError>
[src]
fn verify_message<M>(
&self,
message: &M,
signature: &[u8],
sig0: &SIG
) -> Result<(), ProtoError> where
M: BinEncodable,
[src]
&self,
message: &M,
signature: &[u8],
sig0: &SIG
) -> Result<(), ProtoError> where
M: BinEncodable,
fn verify_rrsig(
&self,
name: &Name,
dns_class: DNSClass,
sig: &SIG,
records: &[Record]
) -> Result<(), ProtoError>
[src]
&self,
name: &Name,
dns_class: DNSClass,
sig: &SIG,
records: &[Record]
) -> Result<(), ProtoError>
Auto Trait Implementations
impl RefUnwindSafe for DNSKEY
impl Send for DNSKEY
impl Sync for DNSKEY
impl Unpin for DNSKEY
impl UnwindSafe for DNSKEY
Blanket Implementations
impl<T> Any for T where
T: 'static + ?Sized,
[src]
T: 'static + ?Sized,
impl<T> Borrow<T> for T where
T: ?Sized,
[src]
T: ?Sized,
impl<T> BorrowMut<T> for T where
T: ?Sized,
[src]
T: ?Sized,
fn borrow_mut(&mut self) -> &mut T
[src]
impl<T> From<T> for T
[src]
impl<T, U> Into<U> for T where
U: From<T>,
[src]
U: From<T>,
impl<T> ToOwned for T where
T: Clone,
[src]
T: Clone,
type Owned = T
The resulting type after obtaining ownership.
fn to_owned(&self) -> T
[src]
fn clone_into(&self, target: &mut T)
[src]
impl<T, U> TryFrom<U> for T where
U: Into<T>,
[src]
U: Into<T>,
type Error = Infallible
The type returned in the event of a conversion error.
fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>
[src]
impl<T, U> TryInto<U> for T where
U: TryFrom<T>,
[src]
U: TryFrom<T>,
type Error = <U as TryFrom<T>>::Error
The type returned in the event of a conversion error.
fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>
[src]
impl<V, T> VZip<V> for T where
V: MultiLane<T>,
V: MultiLane<T>,