19 Kvě
2018
19 Kvě
'18
23:50
Hello
I am using ecdsap256sha256 as algorithm. Why does the KSK DNSKEY (=257) use as digest type
SHA1 (=1) and not SHA256 (=2)?
For example:
dig DNSKEY nic.cz | grep 257
nic.cz. 871 IN
DNSKEY 257 3 13 LM4zvjUgZi2XZKsYooDE0HFYGfWp242fKB+O8sLsuox8S6MJTowY8lBD
jZD7JKbmaNot3+1H8zU9TrDzWmmHwQ==
dig DNSKEY nic.cz | grep 257 > dnspub.key
jdnssec-dstool dnspub.key
nic.cz. 868 IN DS 61281 13 1
091CECC4D2AADB7AC8C4DF413DDF9C5B0B61E5B6
Regards
dp
20 Kvě
20 Kvě
0:16
On 05/19/2018 11:50 PM, dptrash(a)arcor.de wrote:
I am using ecdsap256sha256 as algorithm. Why does the
KSK DNSKEY > (=257) use as digest type SHA1 (=1) and not SHA256 (=2)?
Technically, the DNSKEY algorithm is independent of the DS algorithm
used on it, I believe, though some combinations make less sense than
others. Your example seems more of a question for jdnssec-tools - why
they choose SHA1 and not another one.
--Vladimir
0:26
Thanks for the fast answer. You are right!
Vladimír Čunát <vladimir.cunat(a)nic.cz> hat am
20. Mai 2018 um 00:16 geschrieben:
On 05/19/2018 11:50 PM, dptrash(a)arcor.de mailto:dptrash@arcor.de wrote:
I am using ecdsap256sha256 as algorithm. Why does
the KSK DNSKEY > (=257) use as digest type SHA1 (=1) and not SHA256 (=2)?
Technically, the DNSKEY algorithm is independent of the DS algorithm used on it, I
believe, though some combinations make less sense than others. Your example seems more of
a question for jdnssec-tools - why they choose SHA1 and not another one.
--Vladimir
0:16
Nevermind :)
jdnssec-dstool -d 2 dnspub.key
nic.cz. 312 IN DS
61281 13 2 4104D40C8FE2030BF7A09A199FCF37B36F7EC8DDD16F5A84F2E61C248D3AFD0F
dptrash(a)arcor.de hat am 19. Mai 2018 um 23:50
geschrieben:
Hello
I am using ecdsap256sha256 as algorithm. Why does the KSK DNSKEY (=257) use as digest
type SHA1 (=1) and not SHA256 (=2)?
For example:
dig DNSKEY nic.cz | grep 257
nic.cz.
871 IN DNSKEY 257 3 13 LM4zvjUgZi2XZKsYooDE0HFYGfWp242fKB+O8sLsuox8S6MJTowY8lBD
jZD7JKbmaNot3+1H8zU9TrDzWmmHwQ==
dig DNSKEY nic.cz | grep 257 > dnspub.key
jdnssec-dstool dnspub.key
nic.cz. 868 IN DS 61281 13 1
091CECC4D2AADB7AC8C4DF413DDF9C5B0B61E5B6
Regards
dp
2191
days inactive
2191
days old
3 comments
3 participants
participants (3)
-
dptrash＠arcor.de -
shafire＠arcor.de -
Vladimír Čunát