Package org.xbill.DNS

Class DNSSEC

java.lang.Object

org.xbill.DNS.DNSSEC

public class DNSSEC
extends Object

Constants and methods relating to DNSSEC.

DNSSEC provides authentication for DNS information.

See Also:

• RRSIGRecord
• DNSKEYRecord
• RRset

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	DNSSEC.Algorithm	Domain Name System Security (DNSSEC) Algorithm Numbers.
static class	DNSSEC.Digest	DNSSEC Delegation Signer (DS) Resource Record (RR) Type Digest Algorithms.
static class	DNSSEC.DNSSECException	A DNSSEC exception.
private static class	DNSSEC.ECKeyInfo
static class	DNSSEC.IncompatibleKeyException	The key data provided is inconsistent.
static class	DNSSEC.InvalidDnskeyException	The DNSKEYRecord used for the validation is not a zone signing key.
static class	DNSSEC.KeyMismatchException	A DNSSEC verification failed because fields in the DNSKEY and RRSIG records do not match.
static class	DNSSEC.MalformedKeyException	The cryptographic data in a DNSSEC key is malformed.
static class	DNSSEC.NoSignatureException	No signature was found.
static class	DNSSEC.SignatureExpiredException	A DNSSEC verification failed because the signature has expired.
static class	DNSSEC.SignatureNotYetValidException	A DNSSEC verification failed because the signature has not yet become valid.
static class	DNSSEC.SignatureVerificationException	A DNSSEC verification failed because the cryptographic signature verification failed.
static class	DNSSEC.UnsupportedAlgorithmException	An algorithm is unsupported by this DNSSEC implementation.

Field Summary

Fields

Modifier and Type	Field	Description
(package private) static final int	ASN1_BITSTRING
(package private) static final int	ASN1_INT
(package private) static final int	ASN1_OID
(package private) static final int	ASN1_SEQ
private static final int	DSA_LEN
private static final DNSSEC.ECKeyInfo	ECDSA_P256
private static final DNSSEC.ECKeyInfo	ECDSA_P384
private static final DNSSEC.ECKeyInfo	GOST

Constructor Summary

Constructors

Modifier	Constructor	Description
private	DNSSEC()

Method Summary

Modifier and Type	Method	Description
static String	algString(int alg)	Convert an algorithm number to the corresponding JCA string.
private static IOException	asn1ParseException(Object expected, Object actual)
private static int	bigIntegerLength(BigInteger i)
(package private) static void	checkAlgorithm(PrivateKey key, int alg)
private static void	checkKeyAndSigRecord(SIGBase sig, KEYBase key, Instant date)
static byte[]	digestMessage(SIGRecord sig, Message msg, byte[] previous)	Creates a byte array containing the concatenation of the fields of the SIG(0) record and the message to be signed.
static byte[]	digestRRset(RRSIGRecord rrsig, RRset rrset)	Creates a byte array containing the concatenation of the fields of the SIG record and the RRsets to be signed/verified.
private static void	digestSIG(DNSOutput out, SIGBase sig)
private static byte[]	dsaSignatureFromDNS(byte[] signature, int keyLength, boolean skipT)
private static byte[]	dsaSignatureToDNS(byte[] signature, int rsLen, int t)
private static byte[]	fromDSAPublicKey(DSAPublicKey key)
private static byte[]	fromECDSAPublicKey(ECPublicKey key, DNSSEC.ECKeyInfo keyinfo)
private static byte[]	fromECGOSTPublicKey(ECPublicKey key, DNSSEC.ECKeyInfo keyinfo)
private static byte[]	fromEdDSAPublicKey(PublicKey key)
(package private) static byte[]	fromPublicKey(PublicKey key, int alg)	Builds a DNSKEY record from a PublicKey
private static byte[]	fromRSAPublicKey(RSAPublicKey key)
(package private) static byte[]	generateDSDigest(DNSKEYRecord key, int digestid)	Generate the digest value for a DS key
private static int	getDsaIntLen(byte[] bigint, int dsaLen)
private static boolean	matches(SIGBase sig, KEYBase key)
private static BigInteger	readBigInteger(DNSInput in)
private static BigInteger	readBigInteger(DNSInput in, int len)
private static BigInteger	readBigIntegerLittleEndian(DNSInput in, int len)
private static void	reverseByteArray(byte[] array)
(package private) static byte[]	sign(PrivateKey privkey, PublicKey pubkey, int alg, byte[] data, String provider)
static RRSIGRecord	sign(RRset rrset, DNSKEYRecord key, PrivateKey privkey, Instant inception, Instant expiration)	Generate a DNSSEC signature.
static RRSIGRecord	sign(RRset rrset, DNSKEYRecord key, PrivateKey privkey, Instant inception, Instant expiration, String provider)	Generate a DNSSEC signature.
static RRSIGRecord	sign(RRset rrset, DNSKEYRecord key, PrivateKey privkey, Date inception, Date expiration)	Deprecated. use sign(RRset, DNSKEYRecord, PrivateKey, Instant, Instant)
static RRSIGRecord	sign(RRset rrset, DNSKEYRecord key, PrivateKey privkey, Date inception, Date expiration, String provider)	Deprecated. use sign(RRset, DNSKEYRecord, PrivateKey, Instant, Instant, String)
(package private) static SIGRecord	signMessage(Message message, SIGRecord previous, KEYRecord key, PrivateKey privkey, Instant inception, Instant expiration)
private static PublicKey	toDSAPublicKey(byte[] key)
private static PublicKey	toECDSAPublicKey(byte[] key, DNSSEC.ECKeyInfo keyinfo)
private static PublicKey	toECGOSTPublicKey(byte[] key, DNSSEC.ECKeyInfo keyinfo)
private static PublicKey	toEdDSAPublicKey(byte[] key, byte algId)
(package private) static PublicKey	toPublicKey(int alg, byte[] key, Record r)	Converts a KEY/DNSKEY record into a PublicKey
(package private) static PublicKey	toPublicKey(KEYBase r)	Converts a KEY/DNSKEY record into a PublicKey
private static PublicKey	toRSAPublicKey(byte[] key)
private static void	transformAns1IntToDns(int rsLen, DNSInput in, DNSOutput out)
private static byte[]	trimByteArray(byte[] array)
private static void	verify(KEYBase keyRecord, SIGBase sigRecord, byte[] data, int coveredType)
static void	verify(RRset rrset, RRSIGRecord rrsig, DNSKEYRecord key)	Verify a DNSSEC signature.
static void	verify(RRset rrset, RRSIGRecord rrsig, DNSKEYRecord key, Instant date)	Verify a DNSSEC signature.
static void	verify(RRset rrset, RRSIGRecord rrsig, DNSKEYRecord key, Date date)	Deprecated. use verify(RRset, RRSIGRecord, DNSKEYRecord, Instant)
(package private) static void	verifyMessage(Message message, byte[] bytes, SIGRecord sig, SIGRecord previous, KEYRecord key, Instant now)
private static void	writeAsn1Int(int keyLength, DNSOutput out, byte[] bigint, int bigintLen)
private static void	writeBigInteger(DNSOutput out, BigInteger val)
private static void	writePaddedBigInteger(DNSOutput out, BigInteger val, int len)
private static void	writePaddedBigIntegerLittleEndian(DNSOutput out, BigInteger val, int len)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

GOST

private static final DNSSEC.ECKeyInfo GOST

ECDSA_P256

private static final DNSSEC.ECKeyInfo ECDSA_P256

ECDSA_P384

private static final DNSSEC.ECKeyInfo ECDSA_P384

ASN1_SEQ

static final int ASN1_SEQ

See Also:

• Constant Field Values

ASN1_INT

static final int ASN1_INT

See Also:

• Constant Field Values

ASN1_BITSTRING

static final int ASN1_BITSTRING

See Also:

• Constant Field Values

ASN1_OID

static final int ASN1_OID

See Also:

• Constant Field Values

DSA_LEN

private static final int DSA_LEN

See Also:

• Constant Field Values

Constructor Details

DNSSEC

private DNSSEC()

Method Details

digestSIG

private static void digestSIG(DNSOutput out,
 SIGBase sig)

digestRRset

public static byte[] digestRRset(RRSIGRecord rrsig,
 RRset rrset)

Creates a byte array containing the concatenation of the fields of the SIG record and the RRsets to be signed/verified. This does not perform a cryptographic digest.

Parameters:

rrsig - The RRSIG record used to sign/verify the rrset.

rrset - The data to be signed/verified.

Returns:

The data to be cryptographically signed or verified.

digestMessage

public static byte[] digestMessage(SIGRecord sig,
 Message msg,
 byte[] previous)

Creates a byte array containing the concatenation of the fields of the SIG(0) record and the message to be signed. This does not perform a cryptographic digest.

Parameters:

sig - The SIG record used to sign the rrset.

msg - The message to be signed.

previous - If this is a response, the signature from the query.

Returns:

The data to be cryptographically signed.

bigIntegerLength

private static int bigIntegerLength(BigInteger i)

readBigInteger

private static BigInteger readBigInteger(DNSInput in,
 int len)
                                  throws IOException

Throws:

IOException

readBigInteger

private static BigInteger readBigInteger(DNSInput in)

trimByteArray

private static byte[] trimByteArray(byte[] array)

reverseByteArray

private static void reverseByteArray(byte[] array)

readBigIntegerLittleEndian

private static BigInteger readBigIntegerLittleEndian(DNSInput in,
 int len)
                                              throws IOException

Throws:

IOException

writeBigInteger

private static void writeBigInteger(DNSOutput out,
 BigInteger val)

writePaddedBigInteger

private static void writePaddedBigInteger(DNSOutput out,
 BigInteger val,
 int len)

writePaddedBigIntegerLittleEndian

private static void writePaddedBigIntegerLittleEndian(DNSOutput out,
 BigInteger val,
 int len)

toRSAPublicKey

private static PublicKey toRSAPublicKey(byte[] key)
                                 throws IOException,
GeneralSecurityException

Throws:

IOException

GeneralSecurityException

toDSAPublicKey

private static PublicKey toDSAPublicKey(byte[] key)
                                 throws IOException,
GeneralSecurityException,
DNSSEC.MalformedKeyException

Throws:

IOException

GeneralSecurityException

DNSSEC.MalformedKeyException

toECGOSTPublicKey

private static PublicKey toECGOSTPublicKey(byte[] key,
 DNSSEC.ECKeyInfo keyinfo)
                                    throws IOException,
GeneralSecurityException

Throws:

IOException

GeneralSecurityException

toECDSAPublicKey

private static PublicKey toECDSAPublicKey(byte[] key,
 DNSSEC.ECKeyInfo keyinfo)
                                   throws IOException,
GeneralSecurityException

Throws:

IOException

GeneralSecurityException

toEdDSAPublicKey

private static PublicKey toEdDSAPublicKey(byte[] key,
 byte algId)
                                   throws GeneralSecurityException

Throws:

GeneralSecurityException

toPublicKey

static PublicKey toPublicKey(KEYBase r)
                      throws DNSSEC.DNSSECException

Converts a KEY/DNSKEY record into a PublicKey

Throws:

DNSSEC.DNSSECException

toPublicKey

static PublicKey toPublicKey(int alg,
 byte[] key,
 Record r)
                      throws DNSSEC.DNSSECException

Converts a KEY/DNSKEY record into a PublicKey

Throws:

DNSSEC.DNSSECException

fromRSAPublicKey

private static byte[] fromRSAPublicKey(RSAPublicKey key)

fromDSAPublicKey

private static byte[] fromDSAPublicKey(DSAPublicKey key)

fromECGOSTPublicKey

private static byte[] fromECGOSTPublicKey(ECPublicKey key,
 DNSSEC.ECKeyInfo keyinfo)

fromECDSAPublicKey

private static byte[] fromECDSAPublicKey(ECPublicKey key,
 DNSSEC.ECKeyInfo keyinfo)

fromEdDSAPublicKey

private static byte[] fromEdDSAPublicKey(PublicKey key)

fromPublicKey

static byte[] fromPublicKey(PublicKey key,
 int alg)
                     throws DNSSEC.DNSSECException

Builds a DNSKEY record from a PublicKey

Throws:

DNSSEC.DNSSECException

algString

public static String algString(int alg)
                        throws DNSSEC.UnsupportedAlgorithmException

Convert an algorithm number to the corresponding JCA string.

Parameters:

alg - The algorithm number.

Throws:

DNSSEC.UnsupportedAlgorithmException - The algorithm is unknown.

asn1ParseException

private static IOException asn1ParseException(Object expected,
 Object actual)

dsaSignatureFromDNS

private static byte[] dsaSignatureFromDNS(byte[] signature,
 int keyLength,
 boolean skipT)
                                   throws DNSSEC.DNSSECException,
IOException

Throws:

DNSSEC.DNSSECException

IOException

getDsaIntLen

private static int getDsaIntLen(byte[] bigint,
 int dsaLen)

writeAsn1Int

private static void writeAsn1Int(int keyLength,
 DNSOutput out,
 byte[] bigint,
 int bigintLen)

dsaSignatureToDNS

private static byte[] dsaSignatureToDNS(byte[] signature,
 int rsLen,
 int t)
                                 throws IOException

Throws:

IOException

transformAns1IntToDns

private static void transformAns1IntToDns(int rsLen,
 DNSInput in,
 DNSOutput out)
                                   throws IOException

Throws:

IOException

verify

private static void verify(KEYBase keyRecord,
 SIGBase sigRecord,
 byte[] data,
 int coveredType)
                    throws DNSSEC.DNSSECException

Throws:

DNSSEC.DNSSECException

matches

private static boolean matches(SIGBase sig,
 KEYBase key)

verify

public static void verify(RRset rrset,
 RRSIGRecord rrsig,
 DNSKEYRecord key)
                   throws DNSSEC.DNSSECException

Verify a DNSSEC signature.

Parameters:

rrset - The data to be verified.

rrsig - The RRSIG record containing the signature.

key - The DNSKEY record to verify the signature with.

Throws:

DNSSEC.UnsupportedAlgorithmException - The algorithm is unknown

DNSSEC.MalformedKeyException - The key is malformed

DNSSEC.KeyMismatchException - The key and signature do not match

DNSSEC.SignatureExpiredException - The signature has expired

DNSSEC.SignatureNotYetValidException - The signature is not yet valid

DNSSEC.SignatureVerificationException - The signature does not verify.

DNSSEC.DNSSECException - Some other error occurred.

verify

@Deprecated
public static void verify(RRset rrset,
 RRSIGRecord rrsig,
 DNSKEYRecord key,
 Date date)
                   throws DNSSEC.DNSSECException

Deprecated.

use verify(RRset, RRSIGRecord, DNSKEYRecord, Instant)

Verify a DNSSEC signature.

Parameters:

rrset - The data to be verified.

rrsig - The RRSIG record containing the signature.

key - The DNSKEY record to verify the signature with.

date - The date against which the signature is verified.

Throws:

DNSSEC.UnsupportedAlgorithmException - The algorithm is unknown

DNSSEC.MalformedKeyException - The key is malformed

DNSSEC.KeyMismatchException - The key and signature do not match

DNSSEC.SignatureExpiredException - The signature has expired

DNSSEC.SignatureNotYetValidException - The signature is not yet valid

DNSSEC.SignatureVerificationException - The signature does not verify.

DNSSEC.DNSSECException - Some other error occurred.

verify

public static void verify(RRset rrset,
 RRSIGRecord rrsig,
 DNSKEYRecord key,
 Instant date)
                   throws DNSSEC.DNSSECException

Verify a DNSSEC signature.

Parameters:

rrset - The data to be verified.

rrsig - The RRSIG record containing the signature.

key - The DNSKEY record to verify the signature with.

date - The date against which the signature is verified.

Throws:

DNSSEC.UnsupportedAlgorithmException - The algorithm is unknown

DNSSEC.MalformedKeyException - The key is malformed

DNSSEC.KeyMismatchException - The key and signature do not match

DNSSEC.SignatureExpiredException - The signature has expired

DNSSEC.SignatureNotYetValidException - The signature is not yet valid

DNSSEC.SignatureVerificationException - The signature does not verify.

DNSSEC.DNSSECException - Some other error occurred.

checkKeyAndSigRecord

private static void checkKeyAndSigRecord(SIGBase sig,
 KEYBase key,
 Instant date)
                                  throws DNSSEC.DNSSECException

Throws:

DNSSEC.DNSSECException

sign

static byte[] sign(PrivateKey privkey,
 PublicKey pubkey,
 int alg,
 byte[] data,
 String provider)
            throws DNSSEC.DNSSECException

Throws:

DNSSEC.DNSSECException

checkAlgorithm

static void checkAlgorithm(PrivateKey key,
 int alg)
                    throws DNSSEC.UnsupportedAlgorithmException

Throws:

DNSSEC.UnsupportedAlgorithmException

sign

@Deprecated
public static RRSIGRecord sign(RRset rrset,
 DNSKEYRecord key,
 PrivateKey privkey,
 Date inception,
 Date expiration)
                        throws DNSSEC.DNSSECException

Deprecated.

use sign(RRset, DNSKEYRecord, PrivateKey, Instant, Instant)

Generate a DNSSEC signature. key and privateKey must refer to the same underlying cryptographic key.

Parameters:

rrset - The data to be signed

key - The DNSKEY record to use as part of signing

privkey - The PrivateKey to use when signing

inception - The time at which the signatures should become valid

expiration - The time at which the signatures should expire

Returns:

The generated signature

Throws:

DNSSEC.UnsupportedAlgorithmException - The algorithm is unknown

DNSSEC.MalformedKeyException - The key is malformed

DNSSEC.DNSSECException - Some other error occurred.

sign

@Deprecated
public static RRSIGRecord sign(RRset rrset,
 DNSKEYRecord key,
 PrivateKey privkey,
 Date inception,
 Date expiration,
 String provider)
                        throws DNSSEC.DNSSECException

Deprecated.

use sign(RRset, DNSKEYRecord, PrivateKey, Instant, Instant, String)

Generate a DNSSEC signature. key and privateKey must refer to the same underlying cryptographic key.

Parameters:

rrset - The data to be signed

key - The DNSKEY record to use as part of signing

privkey - The PrivateKey to use when signing

inception - The time at which the signatures should become valid

expiration - The time at which the signatures should expire

Returns:

The generated signature

Throws:

DNSSEC.UnsupportedAlgorithmException - The algorithm is unknown

DNSSEC.MalformedKeyException - The key is malformed

DNSSEC.DNSSECException - Some other error occurred.

sign

public static RRSIGRecord sign(RRset rrset,
 DNSKEYRecord key,
 PrivateKey privkey,
 Instant inception,
 Instant expiration)
                        throws DNSSEC.DNSSECException

Generate a DNSSEC signature. key and privateKey must refer to the same underlying cryptographic key.

Parameters:

rrset - The data to be signed

key - The DNSKEY record to use as part of signing

privkey - The PrivateKey to use when signing

inception - The time at which the signatures should become valid

expiration - The time at which the signatures should expire

Returns:

The generated signature

Throws:

DNSSEC.UnsupportedAlgorithmException - The algorithm is unknown

DNSSEC.MalformedKeyException - The key is malformed

DNSSEC.DNSSECException - Some other error occurred.

sign

public static RRSIGRecord sign(RRset rrset,
 DNSKEYRecord key,
 PrivateKey privkey,
 Instant inception,
 Instant expiration,
 String provider)
                        throws DNSSEC.DNSSECException

Generate a DNSSEC signature. key and privateKey must refer to the same underlying cryptographic key.

Parameters:

rrset - The data to be signed

key - The DNSKEY record to use as part of signing

privkey - The PrivateKey to use when signing

inception - The time at which the signatures should become valid

expiration - The time at which the signatures should expire

provider - The name of the JCA provider. If non-null, it will be passed to JCA getInstance() methods.

Returns:

The generated signature

Throws:

DNSSEC.UnsupportedAlgorithmException - The algorithm is unknown

DNSSEC.MalformedKeyException - The key is malformed

DNSSEC.DNSSECException - Some other error occurred.

signMessage

static SIGRecord signMessage(Message message,
 SIGRecord previous,
 KEYRecord key,
 PrivateKey privkey,
 Instant inception,
 Instant expiration)
                      throws DNSSEC.DNSSECException

Throws:

DNSSEC.DNSSECException

verifyMessage

static void verifyMessage(Message message,
 byte[] bytes,
 SIGRecord sig,
 SIGRecord previous,
 KEYRecord key,
 Instant now)
                   throws DNSSEC.DNSSECException

Throws:

DNSSEC.DNSSECException

generateDSDigest

static byte[] generateDSDigest(DNSKEYRecord key,
 int digestid)

Generate the digest value for a DS key

Parameters:

key - Which is covered by the DS record

digestid - The type of digest

Returns:

The digest value as an array of bytes