Use of GOST 2012 Signature Algorithms in DNSKEY and RRSIG Resource Records for DNSSEC
draft-ietf-dnsop-rfc5933-bis-02
Network Working Group D. Belyavskiy
Internet-Draft TCINET
Obsoletes: 5933 (if approved) V. Dolmatov, Ed.
Intended status: Standards Track JSC "NPK Kryptonite"
Expires: April 1, 2021 September 28, 2020
Use of GOST 2012 Signature Algorithms in DNSKEY and RRSIG Resource
Records for DNSSEC
draft-ietf-dnsop-rfc5933-bis-02
Abstract
This document describes how to produce digital signatures and hash
functions using the GOST R 34.10-2012 and GOST R 34.11-2012
algorithms for DNSKEY, RRSIG, and DS resource records, for use in the
Domain Name System Security Extensions (DNSSEC).
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on April 1, 2021.
Copyright Notice
Copyright (c) 2020 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
Belyavskiy & Dolmatov Expires April 1, 2021 [Page 1]
Internet-Draft Use of GOST 2012 Signatures in DNSSEC September 2020
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3
2. DNSKEY Resource Records . . . . . . . . . . . . . . . . . . . 3
2.1. Using a Public Key with Existing Cryptographic Libraries 3
2.2. GOST DNSKEY RR Example . . . . . . . . . . . . . . . . . 4
3. RRSIG Resource Records . . . . . . . . . . . . . . . . . . . 4
3.1. RRSIG RR Example . . . . . . . . . . . . . . . . . . . . 4
4. DS Resource Records . . . . . . . . . . . . . . . . . . . . . 5
4.1. DS RR Example . . . . . . . . . . . . . . . . . . . . . . 5
5. Deployment Considerations . . . . . . . . . . . . . . . . . . 5
5.1. Key Sizes . . . . . . . . . . . . . . . . . . . . . . . . 5
5.2. Signature Sizes . . . . . . . . . . . . . . . . . . . . . 5
5.3. Digest Sizes . . . . . . . . . . . . . . . . . . . . . . 6
6. Implementation Considerations . . . . . . . . . . . . . . . . 6
6.1. Support for GOST Signatures . . . . . . . . . . . . . . . 6
7. Security Considerations . . . . . . . . . . . . . . . . . . . 6
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6
9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 7
10. References . . . . . . . . . . . . . . . . . . . . . . . . . 7
10.1. Normative References . . . . . . . . . . . . . . . . . . 7
10.2. Informative References . . . . . . . . . . . . . . . . . 8
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 8
1. Introduction
The Domain Name System (DNS) is the global hierarchical distributed
database for Internet Naming. The DNS has been extended to use
cryptographic keys and digital signatures for the verification of the
authenticity and integrity of its data. RFC 4033 [RFC4033], RFC 4034
[RFC4034], and RFC 4035 [RFC4035] describe these DNS Security
Extensions, called DNSSEC.
RFC 4034 describes how to store DNSKEY and RRSIG resource records,
and specifies a list of cryptographic algorithms to use. This
document extends that list with the signature and hash algorithms
GOST R 34.10-2012 ([RFC7091]) and GOST R 34.11-2012 ([RFC6986]), and
specifies how to store DNSKEY data and how to produce RRSIG resource
records with these algorithms.
This document obsoletes RFC5933 [RFC5933]. This document also marks
the DNS Security Algorithm GOST R 34.10-2001 as obsolete.
Belyavskiy & Dolmatov Expires April 1, 2021 [Page 2]
Internet-Draft Use of GOST 2012 Signatures in DNSSEC September 2020
Show full document text