Enum trust_dns_client::rr::dnssec::KeyPair

pub enum KeyPair<K> {
    RSA(PKey<K>),
    EC(PKey<K>),
    ECDSA(EcdsaKeyPair),
    ED25519(Ed25519KeyPair),
}

This is supported on crate feature dnssec only.

A public and private key pair, the private portion is not required.

This supports all the various public/private keys which Trust-DNS is capable of using. Given differing features, some key types may not be available. The openssl feature will enable RSA and EC (P256 and P384). The ring feature enables ED25519, in the future, Ring will also be used for other keys.

Variants

RSA(PKey<K>)

This is supported on crate feature openssl only.

RSA keypair, supported by OpenSSL

EC(PKey<K>)

This is supported on crate feature openssl only.

Elliptic curve keypair, supported by OpenSSL

ECDSA(EcdsaKeyPair)

This is supported on crate feature ring only.

ring ECDSA keypair

ED25519(Ed25519KeyPair)

This is supported on crate feature ring only.

ED25519 encryption and hash defined keypair

Implementations

impl<K> KeyPair<K>

pub fn from_rsa(rsa: OpenSslRsa<K>) -> DnsSecResult<Self>

This is supported on crate feature openssl only.

Creates an RSA type keypair.

pub fn from_rsa_pkey(pkey: PKey<K>) -> Self

This is supported on crate feature openssl only.

Given a known pkey of an RSA key, return the wrapped keypair

pub fn from_ec_key(ec_key: EcKey<K>) -> DnsSecResult<Self>

This is supported on crate feature openssl only.

Creates an EC, elliptic curve, type keypair, only P256 or P384 are supported.

pub fn from_ec_pkey(pkey: PKey<K>) -> Self

This is supported on crate feature openssl only.

Given a known pkey of an EC key, return the wrapped keypair

pub fn from_ecdsa(ec_key: EcdsaKeyPair) -> Self

This is supported on crate feature ring only.

Creates an ECDSA keypair with ring.

pub fn from_ed25519(ed_key: Ed25519KeyPair) -> Self

This is supported on crate feature ring only.

Creates an ED25519 keypair.

impl<K: HasPublic> KeyPair<K>

pub fn to_public_bytes(&self) -> DnsSecResult<Vec<u8>>

Converts this keypair to the DNS binary form of the public_key.

If there is a private key associated with this keypair, it will not be included in this format. Only the public key material will be included.

pub fn to_public_key(&self) -> DnsSecResult<PublicKeyBuf>

Returns a PublicKeyBuf of the KeyPair

pub fn key_tag(&self) -> DnsSecResult<u16>

The key tag is calculated as a hash to more quickly lookup a DNSKEY.

RFC 1035, DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION, November 1987

RFC 2535                DNS Security Extensions               March 1999

4.1.6 Key Tag Field

 The "key Tag" is a two octet quantity that is used to efficiently
 select between multiple keys which may be applicable and thus check
 that a public key about to be used for the computationally expensive
 effort to check the signature is possibly valid.  For algorithm 1
 (MD5/RSA) as defined in [RFC 2537], it is the next to the bottom two
 octets of the public key modulus needed to decode the signature
 field.  That is to say, the most significant 16 of the least
 significant 24 bits of the modulus in network (big endian) order. For
 all other algorithms, including private algorithms, it is calculated
 as a simple checksum of the KEY RR as described in Appendix C.

Appendix C: Key Tag Calculation

 The key tag field in the SIG RR is just a means of more efficiently
 selecting the correct KEY RR to use when there is more than one KEY
 RR candidate available, for example, in verifying a signature.  It is
 possible for more than one candidate key to have the same tag, in
 which case each must be tried until one works or all fail.  The
 following reference implementation of how to calculate the Key Tag,
 for all algorithms other than algorithm 1, is in ANSI C.  It is coded
 for clarity, not efficiency.  (See section 4.1.6 for how to determine
 the Key Tag of an algorithm 1 key.)

 /* assumes int is at least 16 bits
    first byte of the key tag is the most significant byte of return
    value
    second byte of the key tag is the least significant byte of
    return value
    */

 int keytag (

         unsigned char key[],  /* the RDATA part of the KEY RR */
         unsigned int keysize, /* the RDLENGTH */
         )
 {
 long int    ac;    /* assumed to be 32 bits or larger */

 for ( ac = 0, i = 0; i < keysize; ++i )
     ac += (i&1) ? key[i] : key[i]<<8;
 ac += (ac>>16) & 0xFFFF;
 return ac & 0xFFFF;
 }

pub fn to_dnskey(&self, algorithm: Algorithm) -> DnsSecResult<DNSKEY>

Creates a Record that represents the public key for this Signer

Arguments

• algorithm - algorithm of the DNSKEY

Return

the DNSKEY record data

pub fn to_sig0key(&self, algorithm: Algorithm) -> DnsSecResult<KEY>

Convert this keypair into a KEY record type for usage with SIG0 with key type entity (KeyUsage::Entity).

Arguments

• algorithm - algorithm of the KEY

Return

the KEY record data

pub fn to_sig0key_with_usage(
    &self,
    algorithm: Algorithm,
    usage: KeyUsage
) -> DnsSecResult<KEY>

Convert this keypair into a KEY record type for usage with SIG0 with a given key (usage) type.

Arguments

• algorithm - algorithm of the KEY
• usage - the key type

Return

the KEY record data

pub fn to_ds(
    &self,
    name: &Name,
    algorithm: Algorithm,
    digest_type: DigestType
) -> DnsSecResult<DS>

This is supported on crate features openssl or ring only.

Creates a DS record for this KeyPair associated to the given name

Arguments

• name - name of the DNSKEY record covered by the new DS record
• algorithm - the algorithm of the DNSKEY
• digest_type - the digest_type used to

impl<K: HasPrivate> KeyPair<K>

pub fn sign(&self, algorithm: Algorithm, tbs: &TBS) -> DnsSecResult<Vec<u8>>

Signs a hash.

This will panic if the key is not a private key and can be used for signing.

Arguments

• message - the message bytes to be signed, see rrset_tbs.

Return value

The signature, ready to be stored in an RData::RRSIG.

impl KeyPair<Private>

pub fn generate(algorithm: Algorithm) -> DnsSecResult<Self>

Generates a new private and public key pair for the specified algorithm.

RSA keys are hardcoded to 2048bits at the moment. Other keys have predefined sizes.

pub fn generate_pkcs8(algorithm: Algorithm) -> DnsSecResult<Vec<u8>>

This is supported on crate feature ring only.

Generates a key, securing it with pkcs8