Use of the SHA-256 Algorithm with RSA, Digital Signature Algorithm (DSA), and Elliptic Curve DSA (ECDSA) in SSHFP Resource Records
RFC 6594

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 07

Internet Engineering Task Force (IETF)                           O. Sury
Request for Comments: 6594                                        CZ.NIC
Category: Standards Track                                     April 2012
ISSN: 2070-1721

                 Use of the SHA-256 Algorithm with RSA,
                   Digital Signature Algorithm (DSA),
        and Elliptic Curve DSA (ECDSA) in SSHFP Resource Records

Abstract

   This document updates the IANA registries in RFC 4255, which defines
   SSHFP, a DNS Resource Record (RR) that contains a standard Secure
   Shell (SSH) key fingerprint used to verify SSH host keys using DNS
   Security Extensions (DNSSEC).  This document defines additional
   options supporting SSH public keys applying the Elliptic Curve
   Digital Signature Algorithm (ECDSA) and the implementation of
   fingerprints computed using the SHA-256 message digest algorithm in
   SSHFP Resource Records.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   fInternet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc6594.

Copyright Notice

   Copyright (c) 2012 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must

Sury                         Standards Track                    [Page 1]
RFC 6594         ECDSA and SHA-256 Algorithms for SSHFP       April 2012

   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1. Introduction ....................................................3
   2. Requirements Language ...........................................4
   3. SSHFP Resource Records ..........................................4
      3.1. SSHFP Fingerprint Type Specification .......................4
           3.1.1. SHA-256 SSHFP Fingerprint Type Specification ........4
      3.2. SSHFP Algorithm Number Specification .......................4
           3.2.1. ECDSA SSHFP Algorithm Number Specification ..........4
   4. Implementation Considerations ...................................4
      4.1. Support for SHA-256 Fingerprints ...........................4
      4.2. Support for ECDSA ..........................................4
   5. Examples ........................................................5
      5.1. RSA Public Key .............................................5
           5.1.1. RSA Public Key with SHA1 Fingerprint ................5
           5.1.2. RSA Public Key with SHA-256 Fingerprint .............5
      5.2. DSA Public Key .............................................6
           5.2.1. DSA Public Key with SHA1 Fingerprint ................6
           5.2.2. DSA Public Key with SHA-256 Fingerprint .............6
      5.3. ECDSA Public Key ...........................................6
           5.3.1. ECDSA Public Key with SHA1 Fingerprint ..............7
           5.3.2. ECDSA Public Key with SHA-256 Fingerprint ...........7
   6. IANA Considerations .............................................7
      6.1. SSHFP RR Types for Public Key Algorithms ...................7
      6.2. SSHFP RR Types for Fingerprint Types .......................7
   7. Security Considerations .........................................8
   8. References ......................................................8
      8.1. Normative References .......................................8
      8.2. Informative References .....................................9

Sury                         Standards Track                    [Page 2]
RFC 6594         ECDSA and SHA-256 Algorithms for SSHFP       April 2012

1.  Introduction

   The Domain Name System (DNS) is the global, hierarchical distributed
   database for Internet naming.  The Secure Shell (SSH) is a protocol
   for secure remote login and other secure network services over an
   insecure network.  RFC 4253 [RFC4253] defines Public Key Algorithms
   for the Secure Shell server public keys.

   The DNS has been extended to store fingerprints in a DNS Resource
   Record named SSHFP [RFC4255], which provides out-of-band verification