DNSSEC主要的四個資源記錄

1、DNSSEC主要的四個資源記錄主要的四個資源記錄2013年3月DSNSECRRSIGDNSKEYl DNSKEY RR Type Value:48 The public keys are stored in DNSKEY resource records A zone signs its authoritative RRsets by using a private key and stores the corresponding public key in a DNSKEY RR The DNSKEY RR has no special TTL requirements(與RRSIG對比)F

2、lags FieldProtocol FieldAlgorithm FieldPublic Key FieldFlags FieldProtocol FieldAlgorithm FieldPublic Key Fieldu Flags Field a 2 octet Flags Field Bit 7 of the Flags field is the Zone Key flag 1：DNSKEY record for DNS zone key 0：Some other type of DNS public key MUST NOT be used to verify RRSIG Bit 1

3、5 of the Flags field is SEP(Secure Entry Point) flag -RFC3757 1：DNSKEY record used as a SEP(KSK) 0：&Bit 7 setted 1，(ZSK) Bits 0-6 and 8-14 are reserved Possible values are: 0, 256, and 257. Flags FieldProtocol FieldAlgorithm FieldPublic Key Fieldu Protocol Field a 1 octet Protocol Field MUST have va

4、lue 3 Not 3, then DNSKEY is not used for DNSSECFlags FieldProtocol FieldAlgorithm FieldPublic Key Fieldu Algorithm Field a 1 octet Algorithm Field Identifies the public keys cryptographic algorithmFlags FieldProtocol FieldAlgorithm FieldPublic Key Fieldu Public Key Field a more octet Public Key Fiel

5、d Hold the public key material Presented as a Base64 encoding Whitespace is allowed within the Base64 text Base64 defined in RFC3548Flags FieldProtocol FieldAlgorithm FieldPublic Key Fieldl RRSIG RR Type Value:46Digital signatures are stored in RRSIG resource records and are used in the DNSSEC authe

6、ntication processThe TTL value of an RRSIG RR MUST match the TTL value of the RRset it covers Type Covered FieldAlgorithm FieldLabels FieldOriginal TTL FieldSignature Expiration FieldSignature Inception FieldKey Tag FieldSigners Name FieldSignature FieldType Covered FieldAlgorithm FieldLabels FieldO

7、riginal TTL FieldSignature Expiration FieldSignature Inception FieldKey Tag FieldSigners Name FieldSignature Fieldu Type Covered Field a 2 octet Type Covered Field Identifies the type of the rrset covered by this RRSIG recordThe Type Covered field is represented as an RR type mnemonic -RFC3597Type C

8、overed FieldAlgorithm FieldLabels FieldOriginal TTL FieldSignature Expiration FieldSignature Inception FieldKey Tag FieldSigners Name FieldSignature Fieldu Algorithm Field a 1 octet Algorithm Field Key used to create the signatureType Covered FieldAlgorithm FieldLabels FieldOriginal TTL FieldSignatu

9、re Expiration FieldSignature Inception FieldKey Tag FieldSigners Name FieldSignature Fieldu Labels Field a 1 octet Labels Field Specify the number of labels in the original RRSIG RR owner name To determine whether the answer was synthesized from a wildcard Wildcard label is not included in the count

10、 stored in the Labels field . -Labels num is 3 *. -Labels num is 2 Root (.) has a Labels field value of 0Type Covered FieldAlgorithm FieldLabels FieldOriginal TTL FieldSignature Expiration FieldSignature Inception FieldKey Tag FieldSigners Name FieldSignature Fieldu Original TTL Field a 4 octet Orig

11、inal TTL Field SpecifY the TTL in the authoritative zone In order to validate a signature, a validator requires the original TTL How to use for validating，see RFC4035Type Covered FieldAlgorithm FieldLabels FieldOriginal TTL FieldSignature Expiration FieldSignature Inception FieldKey Tag FieldSigners

12、 Name FieldSignature Fieldu Signature Expiration and Inception Fields a 4 octet Expiration and Inception Field,respectively Specify a validity period for the signature The longest interval is approximately 136 years -theoretical value Cannot refer to dates more than 68 years - operational value Repr

13、esented either as an unsigned decimal integer indicating seconds since 1 January 1970 00:00:00 UTC, or in the form YYYYMMDDHHmmSS in UTCType Covered FieldAlgorithm FieldLabels FieldOriginal TTL FieldSignature Expiration FieldSignature Inception FieldKey Tag FieldSigners Name FieldSignature Fieldu Ke

14、y Tag Field a 2 octet Original TTL Field Contains the key tag value of the DNSKEY RR How to calculate? -RFC4034 appendix BType Covered FieldAlgorithm FieldLabels FieldOriginal TTL FieldSignature Expiration FieldSignature Inception FieldKey Tag FieldSigners Name FieldSignature Fieldu Signers Name Fie

15、ld a more octet Original TTL Field Contain the name of the zone of the covered Rrset MUST be represented as a domain nameType Covered FieldAlgorithm FieldLabels FieldOriginal TTL FieldSignature Expiration FieldSignature Inception FieldKey Tag FieldSigners Name FieldSignature Fieldu Signature Field a

16、 more octet Original TTL Field The Signature field contains the cryptographic signature that covers the RRSIG RDATA Represented as a Base64 encoding of the signatureType Covered FieldAlgorithm FieldLabels FieldOriginal TTL FieldSignature Expiration FieldSignature Inception FieldKey Tag FieldSigners

17、Name FieldSignature Fieldl NSEC RR Type Value:47 NSEC RR lists two separate things: the next owner name (in the canonical ordering of the zone) that contains authoritative data the set of RR types present at the NSEC RRs owner name The complete set of NSEC RRs in a zone indicates which authoritative

18、 RRsets exist in a zone and also form a chain of authoritative owner names in the zone(所有的NSEC涵蓋了區(qū)數(shù)據(jù)中的資源記錄，并組成一個權(quán)威數(shù)據(jù)鏈)is used to provide authenticated denial of existence for DNS dataNext Domain Name FieldType Bit Maps FieldNext Domain Name FieldType Bit Maps Fieldu Next Domain Name Field a more oct

19、et Original TTL Field Contains the next owner name the canonical ordering of the zonethat has authoritative data the last NSEC record is the name of the zone apex (SOA RR) represented as a domain nameNext Domain Name FieldType Bit Maps Fieldu Type Bit Maps Field a more octet Original TTL Field Ident

20、ifies the RRset types that exist at the NSEC RRs owner nameNext Domain Name FieldType Bit Maps Fieldl DS RR Type Value:43 Refers to a DNSKEY RR Is used in the DNS DNSKEY authentication process The DS RR and its corresponding DNSKEY RR have the same owner name Stored in different locationsThe DS RR a

21、ppears only on the upper (parental) side of a delegationThe corresponding DNSKEY RR is stored in ower named zoneKey Tag FieldAlgorithm FieldDigest Type FieldDigest FieldKey Tag FieldAlgorithm FieldDigest Type FieldDigest Fieldu Key Tag Field a 2 octet Original TTL Field the key tag of the DNSKEY RR

22、same as the Key Tag of RRSIGKey Tag FieldAlgorithm FieldDigest Type FieldDigest Fieldu Algorithm Field a 1 octet Original TTL Field the algorithm number of the DNSKEY RR is identical to the Algorithm Filed of RRSIG and DNSKEYKey Tag FieldAlgorithm FieldDigest Type FieldDigest Fieldu Digest Type Fiel

23、d a 1 octet Original TTL Field the DS RR refers to a DNSKEY RR by including a digest of that DNSKEY RR the Digest Type field identifies the algorithm used to construct the digestKey Tag FieldAlgorithm FieldDigest Type FieldDigest Fieldu Digest Field a more octet Original TTL Field The DS record refers to a DNSKEY RR by including a digest of that D