]> CZ.NIC

Milesovska 1136/5 Praha 130 00 Czech Republic ondrej.sury@nic.cz

Fastly

Atlanta Georgia United States of America edmonds@mycre.ws

Security Internet Engineering Task Force dnssec eddsa ed25519 ed448 This document describes how to specify Edwards-curve Digital Security Algorithm (EdDSA) keys and signatures in DNS Security (DNSSEC). It uses EdDSA with the choice of two curves: Ed25519 and Ed448.

DNSSEC, which is broadly defined in , , and , uses cryptographic keys and digital signatures to provide authentication of DNS data. Currently, the most popular signature algorithm in use is RSA. GOST and NIST-specified elliptic curve cryptography are also standardized. describes the elliptic curve signature system Edwards-curve Digital Signature Algorithm (EdDSA) and recommends two curves, Ed25519 and Ed448. This document defines the use of DNSSEC's DS, DNSKEY, and RRSIG resource records (RRs) with a new signing algorithm, EdDSA, using a choice of two curves: Ed25519 and Ed448.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

An Ed25519 public key consists of a 32-octet value, which is encoded into the Public Key field of a DNSKEY resource record as a simple bit string. The generation of a public key is defined in Section 5.1.5 of . An Ed448 public key consists of a 57-octet value, which is encoded into the Public Key field of a DNSKEY resource record as a simple bit string. The generation of a public key is defined in Section 5.2.5 of .

An Ed25519 signature consists of a 64-octet value, which is encoded into the Signature field of an RRSIG resource record as a simple bit string. The Ed25519 signature algorithm and verification of the Ed25519 signature are described in Sections 5.1.6 and 5.1.7 of , respectively. An Ed448 signature consists of a 114-octet value, which is encoded into the Signature field of an RRSIG resource record as a simple bit string. The Ed448 signature algorithm and verification of the Ed448 signature are described in Sections 5.2.6 and 5.2.7 of , respectively.

The algorithm number associated with the use of Ed25519 in DS, DNSKEY, and RRSIG resource records is 15. The algorithm number associated with the use of Ed448 in DS, DNSKEY, and RRSIG resource records is 16. This registration is fully defined in the IANA Considerations section.

This document updates the IANA registry "Domain Name System Security (DNSSEC) Algorithm Numbers". The following entries have been added to the registry: Number 15 16 Description Ed25519 Ed448 Mnemonic ED25519 ED448 Zone Signing Y Y Trans. Sec. * * Reference RFC 8080 RFC 8080 * There has been no determination of standardization of the use of this algorithm with Transaction Security.

The security considerations of and are inherited in the usage of Ed25519 and Ed448 in DNSSEC. Ed25519 is intended to operate at around the 128-bit security level and Ed448 at around the 224-bit security level. A sufficiently large quantum computer would be able to break both. Reasonable projections of the abilities of classical computers conclude that Ed25519 is perfectly safe. Ed448 is provided for those applications with relaxed performance requirements and where there is a desire to hedge against analytical attacks on elliptic curves. These assessments could, of course, change in the future if new attacks that work better than the ones known today are found. A private key used for a DNSSEC zone MUST NOT be used for any other purpose than for that zone. Otherwise, cross-protocol or cross-application attacks are possible.

&RFC2119; &RFC4033; &RFC4034; &RFC4035; &RFC7748; &RFC8032; &RFC5933; &RFC6605;

Some of the material in this document is copied liberally from . The authors of this document wish to thank Jan Vcelak, Pieter Lexis, Kees Monshouwer, Simon Josefsson, Paul Hoffman, and others for a review of this document.