starred/hickory-dns

Fork 0

mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-25 03:05:51 +03:00

[GH-ISSUE #41] Support ring in addition to OpenSSL #28

New issue

Closed

opened 2026-03-07 22:18:07 +03:00 by kerem · 12 comments

kerem commented

2026-03-07 22:18:07 +03:00

Owner

Originally created by @bluejekyll on GitHub (Aug 24, 2016).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/41

Depends on

https://github.com/briansmith/ring/pull/226

Originally created by @bluejekyll on GitHub (Aug 24, 2016). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/41 Depends on https://github.com/briansmith/ring/pull/226

kerem

2026-03-07 22:18:07 +03:00

closed this issue
added the
enhance

trust
labels

kerem commented

2026-03-07 22:18:09 +03:00

Author

Owner

@djc commented on GitHub (Sep 11, 2016):

ring-0.4.1 was just released, which has the primitive RSA verification API that you needed.

@djc commented on GitHub (Sep 11, 2016): _ring_-0.4.1 was just released, which has the primitive RSA verification API that you needed.

kerem commented

2026-03-07 22:18:09 +03:00

Author

Owner

@bluejekyll commented on GitHub (Sep 12, 2016):

thanks for the update!

I'll start looking into porting to this.

@bluejekyll commented on GitHub (Sep 12, 2016): thanks for the update! I'll start looking into porting to this.

kerem commented

2026-03-07 22:18:09 +03:00

Author

Owner

@djc commented on GitHub (Sep 12, 2016):

Cool. I'm now subscribed to this, so if you run into any problems (that you're not sure are ring bugs) feel free to post them here.

@djc commented on GitHub (Sep 12, 2016): Cool. I'm now subscribed to this, so if you run into any problems (that you're not sure are _ring_ bugs) feel free to post them here.

kerem commented

2026-03-07 22:18:09 +03:00

Author

Owner

@bluejekyll commented on GitHub (Sep 12, 2016):

Cool, I'm working on some other things with futures, etc. right now. So it might be a week or two before I get started on this.

@bluejekyll commented on GitHub (Sep 12, 2016): Cool, I'm working on some other things with futures, etc. right now. So it might be a week or two before I get started on this.

kerem commented

2026-03-07 22:18:09 +03:00

Author

Owner

@briansmith commented on GitHub (Oct 11, 2016):

I think it might be easier to do #43 before this. Then the client and server sides could be done separately. As far as ring's functionality is concerned, I think it implements all the client-side stuff, but it hasn't yet implemented RSA keygen or ECDSA signing for server-side stuff. ECDSA signing is relatively easy to add to ring but it might be a while before RSA keygen comes up. I imagine, though, that there's a lot more interest in getting ring + the TrustDNS client working than ring + the TrustDNS server, because the weight of OpenSSL matters much less for servers than clients (IMO).

@briansmith commented on GitHub (Oct 11, 2016): I think it might be easier to do #43 before this. Then the client and server sides could be done separately. As far as _ring_'s functionality is concerned, I think it implements all the client-side stuff, but it hasn't yet implemented RSA keygen or ECDSA signing for server-side stuff. ECDSA signing is relatively easy to add to _ring_ but it might be a while before RSA keygen comes up. I imagine, though, that there's a lot more interest in getting _ring_ + the TrustDNS client working than _ring_ + the TrustDNS server, because the weight of OpenSSL matters much less for servers than clients (IMO).

kerem commented

2026-03-07 22:18:09 +03:00

Author

Owner

@bluejekyll commented on GitHub (Oct 11, 2016):

That's a great idea.

I looked briefly at splitting the Client/Server just the other day. I'm planning to work on that after I complete my futures work.

@bluejekyll commented on GitHub (Oct 11, 2016): That's a great idea. I looked briefly at splitting the Client/Server just the other day. I'm planning to work on that after I complete my futures work.

kerem commented

2026-03-07 22:18:09 +03:00

Author

Owner

@briansmith commented on GitHub (Nov 9, 2016):

The client/server split seems to have been done in #68.

Regarding RSA support in ring, keep in mind that ring currently only supports RSA public keys of 2048 bits and larger. IIUC, the current root key is 1024 bits and "The new key signing key will be available on the Internet Assigned Numbers Authority website in February 2017, and it will appear in the DNS for the first time on July 11, 2017." See also https://blog.verisign.com/security/increasing-the-strength-of-the-zone-signing-key-for-the-root-zone-part-ii/. I don't know the schedule for the entire DNSSEC hierarchy to move to 2048-bit keys, though.

Regarding ECDSA verification in ring using the fixed-length eky format, it should be done within November.

I filed #60 to add EdDSA support to Trust-DNS. Note that EdDSA support in ring is already done, both for signing and verification. It might make sense to try EdDSA first.

@briansmith commented on GitHub (Nov 9, 2016): The client/server split seems to have been done in #68. Regarding RSA support in _ring_, keep in mind that _ring_ currently only supports RSA public keys of 2048 bits and larger. IIUC, the current root key is 1024 bits and "The new key signing key will be available on the Internet Assigned Numbers Authority website in February 2017, and it will appear in the DNS for the first time on July 11, 2017." See also https://blog.verisign.com/security/increasing-the-strength-of-the-zone-signing-key-for-the-root-zone-part-ii/. I don't know the schedule for the entire DNSSEC hierarchy to move to 2048-bit keys, though. Regarding ECDSA verification in _ring_ using the fixed-length eky format, it should be done within November. I filed #60 to add EdDSA support to Trust-DNS. Note that EdDSA support in _ring_ is already done, both for signing and verification. It might make sense to try EdDSA first.

kerem commented

2026-03-07 22:18:09 +03:00

Author

Owner

@bluejekyll commented on GitHub (Nov 9, 2016):

This is the current root key used in Trust-DNS: https://github.com/bluejekyll/trust-dns/blob/master/client/src/rr/dnssec/Kjqmt7v.pem

It's 2048, so that should be good, no?

@bluejekyll commented on GitHub (Nov 9, 2016): This is the current root key used in Trust-DNS: https://github.com/bluejekyll/trust-dns/blob/master/client/src/rr/dnssec/Kjqmt7v.pem It's 2048, so that should be good, no?

kerem commented

2026-03-07 22:18:09 +03:00

Author

Owner

@briansmith commented on GitHub (Nov 9, 2016):

This is the current root key used in Trust-DNS: https://github.com/bluejekyll/trust-dns/blob/master/client/src/rr/dnssec/Kjqmt7v.pem

It's 2048, so that should be good, no?

ring supports keys from 2048 through 8192 bits, so that's good. Whether all or enough of the RSA keys underneath the root key are 2048+ bits is another issue. That is, either you might decide that Trust-DNS is only going to support secure key sizes, in which you are good to go with ring for RSA, and/or you might want to find out how frequently smaller keys are still being used.

@briansmith commented on GitHub (Nov 9, 2016): > This is the current root key used in Trust-DNS: https://github.com/bluejekyll/trust-dns/blob/master/client/src/rr/dnssec/Kjqmt7v.pem > > It's 2048, so that should be good, no? _ring_ supports keys from 2048 through 8192 bits, so that's good. Whether all or enough of the RSA keys underneath the root key are 2048+ bits is another issue. That is, either you might decide that Trust-DNS is only going to support secure key sizes, in which you are good to go with _ring_ for RSA, and/or you might want to find out how frequently smaller keys are still being used.

kerem commented

2026-03-07 22:18:09 +03:00

Author

Owner

@bluejekyll commented on GitHub (Nov 10, 2016):

ah yes... I think we can wait until someone decides they want that. for now, assuming that we'll only validate secure key sizes is fine for my own use cases.

@bluejekyll commented on GitHub (Nov 10, 2016): ah yes... I think we can wait until someone decides they want that. for now, assuming that we'll only validate secure key sizes is fine for my own use cases.

kerem commented

2026-03-07 22:18:09 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jan 10, 2017):

FYI, ed25519 support just landed in master. My plan right now is to support both openssl and ring in through features.

@bluejekyll commented on GitHub (Jan 10, 2017): FYI, ed25519 support just landed in master. My plan right now is to support both openssl and ring in through features.

kerem commented

2026-03-07 22:18:09 +03:00

Author

Owner

@bluejekyll commented on GitHub (Feb 28, 2017):

Landed in master. Ring is an optional feature, as I had some compile issues in 1.13, current min version for trust-dns.

--features=ring

@bluejekyll commented on GitHub (Feb 28, 2017): Landed in master. Ring is an optional feature, as I had some compile issues in 1.13, current min version for trust-dns. --features=ring

kerem referenced this issue

2026-03-15 21:56:52 +03:00

[GH-ISSUE #28] Wildcard is not handled correctly when verifying RRset #319

kerem referenced this issue

2026-03-16 01:53:28 +03:00

[PR #31] [MERGED] fixes #28: wildcard names in dnssec signing and validation #1200