[PR #2756] [MERGED] proto: add algorithm identifier to TrustAnchor #3290

New issue

Closed

opened 2026-03-16 11:35:46 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:35:46 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2756
Author: @divergentdave
Created: 2/7/2025
Status: ✅ Merged
Merged: 2/8/2025
Merged by: @divergentdave

Base: main ← Head: david/trust-anchor-check-algorithm

📝 Commits (1)

9fed3fc proto: add algorithm identifier to TrustAnchor

📊 Changes

3 files changed (+22 additions, -10 deletions)

View changed files

📝 crates/proto/src/dnssec/dnssec_dns_handle/mod.rs (+1 -1)
📝 crates/proto/src/dnssec/public_key.rs (+1 -0)
📝 crates/proto/src/dnssec/trust_anchor.rs (+20 -9)

📄 Description

This changes the API of the TrustAnchor to take an algorithm as well, and compares both the encoded public key and algorithm identifier when testing membership. This prevents confusion between unrelated algorithms, or hash algorithm downgrades.

The trust anchor's current behavior isn't exploitable, because the three ECC algorithms all have different public key sizes, and downgrading from RSASHA256/RSASHA512 to RSASHA1 requires a SHA-1 second preimage attack for a complete break, which is impractical. As new algorithms are added, failing to check the algorithm type could get more dangerous.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2756 **Author:** [@divergentdave](https://github.com/divergentdave) **Created:** 2/7/2025 **Status:** ✅ Merged **Merged:** 2/8/2025 **Merged by:** [@divergentdave](https://github.com/divergentdave) **Base:** `main` ← **Head:** `david/trust-anchor-check-algorithm` --- ### 📝 Commits (1) - [`9fed3fc`](https://github.com/hickory-dns/hickory-dns/commit/9fed3fcd0830867b77468a9528f74f37fa516e41) proto: add algorithm identifier to TrustAnchor ### 📊 Changes **3 files changed** (+22 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `crates/proto/src/dnssec/dnssec_dns_handle/mod.rs` (+1 -1) 📝 `crates/proto/src/dnssec/public_key.rs` (+1 -0) 📝 `crates/proto/src/dnssec/trust_anchor.rs` (+20 -9) </details> ### 📄 Description This changes the API of the `TrustAnchor` to take an algorithm as well, and compares both the encoded public key and algorithm identifier when testing membership. This prevents confusion between unrelated algorithms, or hash algorithm downgrades. The trust anchor's current behavior isn't exploitable, because the three ECC algorithms all have different public key sizes, and downgrading from RSASHA256/RSASHA512 to RSASHA1 requires a SHA-1 second preimage attack for a complete break, which is impractical. As new algorithms are added, failing to check the algorithm type could get more dangerous. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>