Subject: Re: DS design questions

From: Brian Wellington <[email-masked]>
Date: Mon, 26 Aug 2002 11:17:59 -0700 (PDT)

On Mon, 26 Aug 2002, Bill Manning wrote:

>     --  allowable key lengths.  there is a desire to use keys larger than
> 	the 1024 at some points in the DNS heirarchy.

RSA is defined for up to 4096 bits in RFC 3110.  I don't know of any 
problems using the bind-provided key generation program / signing tools 
with keys this large, except that performance is really bad (which is a 
limitation of modern hardware).  The DSA algorithm is only defined to 1024 
bits, so there's nothing DNSSEC can do.

>     --  are there any other signing tools than those that come with the
> 	bind distribution?

I don't know of any other public tools.

Brian

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Olaf Kolkman <[email-masked]>
Date: Tue, 27 Aug 2002 08:35:39 +0200

*     --  are there any other signing tools than those that come with the
 * 	bind distribution?

Net::DNS::RR::SIG (from the Net::DNS::SEC package, on
www.ripe.net/disi and CPAN has a create method with which you can make
signatures.) You can use that to generate signatures. To sign a zone
file you need more code. Can be done but in perl it is slow.

I have made a signer once, it will need to be worked on a little and I
do not think it is suitable for real distribution so to speak. If you
want to toy with it send me a message.

--Olaf

--------------------------------------------| Olaf M. Kolkman
                                            | www.ripe.net/disi