Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

KeyTag for RSAMD5 seems to be wrong #1352

Closed
ulrichwisser opened this issue Mar 30, 2022 · 0 comments · Fixed by #1353
Closed

KeyTag for RSAMD5 seems to be wrong #1352

ulrichwisser opened this issue Mar 30, 2022 · 0 comments · Fixed by #1353

Comments

@ulrichwisser
Copy link

ulrichwisser commented Mar 30, 2022

I have tried to create keys with keytag collision. While doing this I found that this golang dns library seems to compute false keytags for these keys.
I have created the keys with ldns and ldns computes the same keytag for both keys. I have loaded the keys into knot and retrieved with kdig and kdig computes the same keytag for both keys and the same as ldns.
Keytags for other algorithms are correct.
I have written a short test script to show the error.

package main

import (
	"fmt"

	"github.com/miekg/dns"
)

func main() {
	rr1, _ := dns.NewRR("test. IN      DNSKEY  257 3 13 +s9JyBVaDVllZjVM1sgpXZxjo13cz/KHiYfQ0P14BaUYcy8/L8b57AU3AoZ0/Ken5lG+ZO9biPC8Ek+XVn55BQ== ;{id = 185 (ksk), size = 256b}")
	rr2, _ := dns.NewRR("test. IN      DNSKEY  257 3 13 muZog6Q/E0r76zzPY7sN6hlE/LyKwaw/ymjhlBUbN6pTjm0DlQ5YkxjhliihD8wGJ0Jc35y0ETzDZSMEyA6msg== ;{id = 185 (ksk), size = 256b}")
	rr3, _ := dns.NewRR("test.	IN	DNSKEY	257 3 1 AwEAAcntNdoMnY8pvyPcpDTAaiqHyAhf53XUBANq166won/fjBFvmuzhTuP5r4el/pV0tzEBL73zpoU48BqF66uiL+qRijXCySJiaBUvLNll5rpwuduAOoVpmwOmkC4fV6izHOAx/Uy8c+pYP0YR8+1P7GuTFxgnMmt9sUGtoe+la0X/ ;{id = 27461 (ksk), size = 1024b}")
	rr4, _ := dns.NewRR("test.	IN	DNSKEY	257 3 1 AwEAAf0bKO/m45ylk5BlSLmQHQRBLx1m/ZUXvyPFB387bJXxnTk6so3ub97L1RQ+8bOoiRh3Qm5EaYihjco7J8b/W5WbS3tVsE79nY584RfTKT2zcZ9AoFP2XLChXxPIf/6l0H9n6sH0aBjsG8vabEIp8e06INM3CXVPiMRPPeGNa0Ub ;{id = 27461 (ksk), size = 1024b}")

	fmt.Printf("Key 1: keytag is %5d, expected   185\n", rr1.(*dns.DNSKEY).KeyTag())
	fmt.Printf("Key 2: keytag is %5d, expected   185\n", rr2.(*dns.DNSKEY).KeyTag())
	fmt.Printf("Key 3: keytag is %5d, expected 27461\n", rr3.(*dns.DNSKEY).KeyTag())
	fmt.Printf("Key 4: keytag is %5d, expected 27461\n", rr4.(*dns.DNSKEY).KeyTag())
}

output on my system is

Key 1: keytag is   185, expected   185
Key 2: keytag is   185, expected   185
Key 3: keytag is 17919, expected 27461
Key 4: keytag is 17691, expected 27461
miekg added a commit that referenced this issue Mar 31, 2022
Of course the wording was changed (for the better) in an errata:
https://www.rfc-editor.org/errata/eid193

We still followed the original RFC4034 text. Note I haven't given this
much thought, just changed the 2 into a 3 and ran the test.

Fixes: #1352

Signed-off-by: Miek Gieben <miek@miek.nl>
miekg added a commit that referenced this issue Apr 1, 2022
Of course the wording was changed (for the better) in an errata:
https://www.rfc-editor.org/errata/eid193

We still followed the original RFC4034 text. Note I haven't given this
much thought, just changed the 2 into a 3 and ran the test.

Fixes: #1352

Signed-off-by: Miek Gieben <miek@miek.nl>
aanm pushed a commit to cilium/dns that referenced this issue Jul 29, 2022
Of course the wording was changed (for the better) in an errata:
https://www.rfc-editor.org/errata/eid193

We still followed the original RFC4034 text. Note I haven't given this
much thought, just changed the 2 into a 3 and ran the test.

Fixes: miekg#1352

Signed-off-by: Miek Gieben <miek@miek.nl>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant