Struct DNSKEY

pub struct DNSKEY { /* private fields */ }

Available on crate feature dnssec only.

RFC 4034, DNSSEC Resource Records, March 2005

2.  The DNSKEY Resource Record

   DNSSEC uses public key cryptography to sign and authenticate DNS
   resource record sets (RRsets).  The public keys are stored in DNSKEY
   resource records and are used in the DNSSEC authentication process
   described in [RFC4035]: A zone signs its authoritative RRsets by
   using a private key and stores the corresponding public key in a
   DNSKEY RR.  A resolver can then use the public key to validate
   signatures covering the RRsets in the zone, and thus to authenticate
   them.

   The DNSKEY RR is not intended as a record for storing arbitrary
   public keys and MUST NOT be used to store certificates or public keys
   that do not directly relate to the DNS infrastructure.

   The Type value for the DNSKEY RR type is 48.

   The DNSKEY RR is class independent.

   The DNSKEY RR has no special TTL requirements.

2.1.  DNSKEY RDATA Wire Format

   The RDATA for a DNSKEY RR consists of a 2 octet Flags Field, a 1
   octet Protocol Field, a 1 octet Algorithm Field, and the Public Key
   Field.

                        1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |              Flags            |    Protocol   |   Algorithm   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   /                                                               /
   /                            Public Key                         /
   /                                                               /
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

2.1.5.  Notes on DNSKEY RDATA Design

   Although the Protocol Field always has value 3, it is retained for
   backward compatibility with early versions of the KEY record.

Implementations

impl DNSKEY

pub fn from_key(public_key: &dyn PublicKey, algorithm: Algorithm) -> Self

Create a DNSKEY record representing a public_key.

Arguments

• algorithm - algorithm of the DNSKEY

Return

the DNSKEY record data

pub fn new( zone_key: bool, secure_entry_point: bool, revoke: bool, algorithm: Algorithm, public_key: Vec<u8>, ) -> Self

Construct a new DNSKey RData

Arguments

• zone_key - this key is used to sign Zone resource records
• secure_entry_point - this key is used to sign DNSKeys that sign the Zone records
• revoke - this key has been revoked
• algorithm - specifies the algorithm which this Key uses to sign records
• public_key - the public key material, in native endian, the emitter will perform any necessary conversion

Return

A new DNSKEY RData for use in a Resource Record

pub fn zone_key(&self) -> bool

RFC 4034, DNSSEC Resource Records, March 2005

2.1.1.  The Flags Field

   Bit 7 of the Flags field is the Zone Key flag.  If bit 7 has value 1,
   then the DNSKEY record holds a DNS zone key, and the DNSKEY RR's
   owner name MUST be the name of a zone.  If bit 7 has value 0, then
   the DNSKEY record holds some other type of DNS public key and MUST
   NOT be used to verify RRSIGs that cover RRsets.


   Bits 0-6 and 8-14 are reserved: these bits MUST have value 0 upon
   creation of the DNSKEY RR and MUST be ignored upon receipt.

pub fn secure_entry_point(&self) -> bool

RFC 4034, DNSSEC Resource Records, March 2005

2.1.1.  The Flags Field

   Bit 15 of the Flags field is the Secure Entry Point flag, described
   in [RFC3757].  If bit 15 has value 1, then the DNSKEY record holds a
   key intended for use as a secure entry point.  This flag is only
   intended to be a hint to zone signing or debugging software as to the
   intended use of this DNSKEY record; validators MUST NOT alter their
   behavior during the signature validation process in any way based on
   the setting of this bit.  This also means that a DNSKEY RR with the
   SEP bit set would also need the Zone Key flag set in order to be able
   to generate signatures legally.  A DNSKEY RR with the SEP set and the
   Zone Key flag not set MUST NOT be used to verify RRSIGs that cover
   RRsets.

pub fn is_key_signing_key(&self) -> bool

A KSK has a flags value of 257

pub fn revoke(&self) -> bool

RFC 5011, Trust Anchor Update, September 2007

RFC 5011                  Trust Anchor Update             September 2007

7.  IANA Considerations

  The IANA has assigned a bit in the DNSKEY flags field (see Section 7
  of [RFC4034]) for the REVOKE bit (8).

pub fn algorithm(&self) -> Algorithm

RFC 4034, DNSSEC Resource Records, March 2005

2.1.3.  The Algorithm Field

   The Algorithm field identifies the public key's cryptographic
   algorithm and determines the format of the Public Key field.  A list
   of DNSSEC algorithm types can be found in Appendix A.1

pub fn public_key(&self) -> &[u8]

RFC 4034, DNSSEC Resource Records, March 2005

2.1.4.  The Public Key Field

   The Public Key Field holds the public key material.  The format
   depends on the algorithm of the key being stored and is described in
   separate documents.

pub fn flags(&self) -> u16

Output the encoded form of the flags

pub fn to_digest( &self, name: &Name, digest_type: DigestType, ) -> Result<Digest, ProtoError>

Available on crate features dnssec-openssl or dnssec-ring only.

Creates a message digest for this DNSKEY record.

5.1.4.  The Digest Field

   The DS record refers to a DNSKEY RR by including a digest of that
   DNSKEY RR.

   The digest is calculated by concatenating the canonical form of the
   fully qualified owner name of the DNSKEY RR with the DNSKEY RDATA,
   and then applying the digest algorithm.

     digest = digest_algorithm( DNSKEY owner name | DNSKEY RDATA);

      "|" denotes concatenation

     DNSKEY RDATA = Flags | Protocol | Algorithm | Public Key.

   The size of the digest may vary depending on the digest algorithm and
   DNSKEY RR size.  As of the time of this writing, the only defined
   digest algorithm is SHA-1, which produces a 20 octet digest.

Arguments

• name - the label of of the DNSKEY record.
• digest_type - the DigestType with which to create the message digest.

pub fn calculate_key_tag(&self) -> Result<u16, ProtoError>

The key tag is calculated as a hash to more quickly lookup a DNSKEY.

RFC 2535, Domain Name System Security Extensions, March 1999

RFC 2535                DNS Security Extensions               March 1999

4.1.6 Key Tag Field

 The "key Tag" is a two octet quantity that is used to efficiently
 select between multiple keys which may be applicable and thus check
 that a public key about to be used for the computationally expensive
 effort to check the signature is possibly valid.  For algorithm 1
 (MD5/RSA) as defined in [RFC 2537], it is the next to the bottom two
 octets of the public key modulus needed to decode the signature
 field.  That is to say, the most significant 16 of the least
 significant 24 bits of the modulus in network (big endian) order. For
 all other algorithms, including private algorithms, it is calculated
 as a simple checksum of the KEY RR as described in Appendix C.

Appendix C: Key Tag Calculation

 The key tag field in the SIG RR is just a means of more efficiently
 selecting the correct KEY RR to use when there is more than one KEY
 RR candidate available, for example, in verifying a signature.  It is
 possible for more than one candidate key to have the same tag, in
 which case each must be tried until one works or all fail.  The
 following reference implementation of how to calculate the Key Tag,
 for all algorithms other than algorithm 1, is in ANSI C.  It is coded
 for clarity, not efficiency.  (See section 4.1.6 for how to determine
 the Key Tag of an algorithm 1 key.)

 /* assumes int is at least 16 bits
    first byte of the key tag is the most significant byte of return
    value
    second byte of the key tag is the least significant byte of
    return value
    */

 int keytag (

         unsigned char key[],  /* the RDATA part of the KEY RR */
         unsigned int keysize, /* the RDLENGTH */
         )
 {
 long int    ac;    /* assumed to be 32 bits or larger */

 for ( ac = 0, i = 0; i < keysize; ++i )
     ac += (i&1) ? key[i] : key[i]<<8;
 ac += (ac>>16) & 0xFFFF;
 return ac & 0xFFFF;
 }

pub fn calculate_key_tag_internal(bytes: &[u8]) -> u16

Internal checksum function (used for non-RSAMD5 hashes only, however, RSAMD5 is considered deprecated and not implemented in hickory-dns, anyways).

Trait Implementations

impl BinEncodable for DNSKEY

fn emit(&self, encoder: &mut BinEncoder<'_>) -> Result<(), ProtoError>

Write the type to the stream

fn to_bytes(&self) -> Result<Vec<u8>, ProtoError>

Returns the object in binary form

impl Clone for DNSKEY

fn clone(&self) -> DNSKEY

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DNSKEY

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for DNSKEY

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for DNSKEY

RFC 4034, DNSSEC Resource Records, March 2005

2.2.  The DNSKEY RR Presentation Format

   The presentation format of the RDATA portion is as follows:

   The Flag field MUST be represented as an unsigned decimal integer.
   Given the currently defined flags, the possible values are: 0, 256,
   and 257.

   The Protocol Field MUST be represented as an unsigned decimal integer
   with a value of 3.

   The Algorithm field MUST be represented either as an unsigned decimal
   integer or as an algorithm mnemonic as specified in Appendix A.1.

   The Public Key field MUST be represented as a Base64 encoding of the
   Public Key.  Whitespace is allowed within the Base64 text.  For a
   definition of Base64 encoding, see [RFC3548].

2.3.  DNSKEY RR Example

   The following DNSKEY RR stores a DNS zone key for example.com.

   example.com. 86400 IN DNSKEY 256 3 5 ( AQPSKmynfzW4kyBv015MUG2DeIQ3
                                          Cbl+BBZH4b/0PY1kxkmvHjcZc8no
                                          kfzj31GajIQKY+5CptLr3buXA10h
                                          WqTkF7H6RfoRqXQeogmMHfpftf6z
                                          Mv1LyBUgia7za6ZEzOJBOztyvhjL
                                          742iU/TpPSEDhm2SNKLijfUppn1U
                                          aNvv4w==  )

   The first four text fields specify the owner name, TTL, Class, and RR
   type (DNSKEY).  Value 256 indicates that the Zone Key bit (bit 7) in
   the Flags field has value 1.  Value 3 is the fixed Protocol value.
   Value 5 indicates the public key algorithm.  Appendix A.1 identifies
   algorithm type 5 as RSA/SHA1 and indicates that the format of the
   RSA/SHA1 public key field is defined in [RFC3110].  The remaining
   text is a Base64 encoding of the public key.

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl From<DNSKEY> for RData

fn from(key: DNSKEY) -> Self

Converts to this type from the input type.

impl Hash for DNSKEY

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for DNSKEY

fn eq(&self, other: &DNSKEY) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl RecordData for DNSKEY

fn try_from_rdata(data: RData) -> Result<Self, RData>

Attempts to convert to this RecordData from the RData type, if it is not the correct type the original is returned

fn try_borrow(data: &RData) -> Option<&Self>

Attempts to borrow this RecordData from the RData type, if it is not the correct type the original is returned

fn record_type(&self) -> RecordType

Get the associated RecordType for the RecordData

fn into_rdata(self) -> RData

Converts this RecordData into generic RecordData

fn is_update(&self) -> bool

RDLENGTH = 0

impl Serialize for DNSKEY

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Verifier for DNSKEY

fn algorithm(&self) -> Algorithm

Return the algorithm which this Verifier covers

fn key(&self) -> Result<Arc<dyn PublicKey + '_>, ProtoError>

Return the public key associated with this verifier

fn verify(&self, hash: &[u8], signature: &[u8]) -> Result<(), ProtoError>

Verifies the hash matches the signature with the current key.

fn verify_message<M: BinEncodable>( &self, message: &M, signature: &[u8], sig0: &SIG, ) -> Result<(), ProtoError>

Verifies a message with the against the given signature, i.e. SIG0

fn verify_rrsig<'a>( &self, name: &Name, dns_class: DNSClass, sig: &RRSIG, records: impl Iterator<Item = &'a Record>, ) -> Result<(), ProtoError>

Verifies an RRSig with the associated key, e.g. DNSKEY

impl Eq for DNSKEY

impl StructuralPartialEq for DNSKEY