DNSSEC/Requirements

2016-12-15T22:44:00+00:00

DNSSEC Requirements

Questions

Should we even support SHA-1?
GOST?

Must implement

Target DNSSEC Algorithms:

RSA/SHA-256 (RFC 5702)
RSA/SHA-512 (RFC 5702)

Algorithms:

Hash: SHA-256
Hash: SHA-512
Sign: RSA

Required PKCS11 Mechs:

CKM_RSA_PKCS_KEY_PAIR_GEN
CKM_SHA256_RSA_PKCS
CKM_SHA512_RSA_PKCS
CKM_RSA_PKCS (possible cross-check hash with CKM_SHA256 and CKM_SHA512 before signing)
CKM_SHA256
CKM_SHA512

Should implement

Target DNSSEC Algorithms:

ECDSA/P-256/SHA-256 (RFC 6605)
ECDSA/P-384/SHA-384 (RFC 6605)

Algorithms:

Hash: SHA-256
Hash: SHA-384
Sign: P-256
Sign: P-384

Required PKCS11 Mechs:

CKM_EC_KEY_PAIR_GEN
CKM_ECDSA_SHA256
CKM_ECDSA_SHA384
CKM_ECDSA (possible cross-check hash with CKM_SHA256 and CKM_SHA512 before signing)
CKM_SHA256
CKM_SHA384

May implement

Target DNSSEC Algorithms:

RSA/SHA-1 (RFC 3110)
GOST (RFC 5933)

Algorithms:

Hash: SHA-1
Sign: RSA
Hash: GOST R 34.11-94 (RFC5831)
Sign: GOST R 34.10-2001 (RFC5832)

Required PKCS11 Mechs:

CKM_RSA_PKCS_KEY_PAIR_GEN
CKM_RSA_PKCS (possible cross-check hash with CKM_SHA_1)
CKM_SHA1_RSA_PKCS
CKM_SHA_1
CKM_GOSTR3410_KEY_PAIR_GEN
CKM_GOSTR3410_WITH_GOSTR3411

DNSSEC

2016-12-15T22:43:00+00:00

DNSSEC Requirements

DNSSEC signing using OpenDNSSEC and a Cryptech alpha board rev03

2016-12-15T22:43:00+00:00

Before you start, you'll need

A Cryptech Alpha board, preferrably revision "rev03"
APT on the host system configured to find packages in the Cryptech repository, see BinaryPackages for instructions

apt-get install cryptech-alpha opendnssec opensc

Once you have the software package installed, you may need to upgrade your HSM's firmware.

Configure the HSM

For now, connect USB cables to both the DATA and MGMT ports of your HSM and plug them into the host where you will be running OpenDNSSEC. In production use it should not be necessary to leave the MGMT port connected, but it's easier to set up this way, and, as this is still a development platform, this is the configuration that's gotten the most testing.

# eval $(cryptech_probe)
# cryptech_muxd &
# cryptech_console

Username: wheel
Password: YouReallyNeedToChangeThisPINRightNowWeAreNotKidding

cryptech> keystore set pin wheel supersikritnewpw
cryptech> keystore set pin so 123456
cryptech> keystore set pin user 1234

cryptech> masterkey set EFBEADDE
^C

Leave cryptech_muxd running, so that the PKCS #11 library can use it to talk to the HSM.

Configure OpenDNSSEC

mkdir /var/lib/opendnssec/cryptech

cat > /var/lib/opendnssec/unsigned/example.com << EOF
\$TTL 600
example.com.  IN SOA  hidden-master.example.com. hostmaster.example.com. (
                                2016041401 ; serial
                                720        ; 28800      ; refresh (8 hours)
                                720        ; 7200       ; retry (2 hours)
                                300        ; 604800     ; expire (1 week)
                                120        ; 3600       ; minimum (1 hour)
                                )

               NS      lab.cryptech.is.
test           A       127.0.0.1
EOF

chown -R opendnssec: /var/lib/opendnssec/*

OpenDNSSEC configuration changes

/etc/opendnssec/conf.xml:

<Repository name="Cryptech">
        <Module>/usr/lib/libcryptech-pkcs11.so</Module>
        <TokenLabel>Cryptech Token</TokenLabel>
        <PIN>1234</PIN>
        <SkipPublicKey/>
</Repository>

The PIN is whatever was chosen as PIN for 'user' above. The TokenLabel has to be "Cryptech Token", not something you choose.

/etc/opendnssec/kasp.xml:

s/SoftHSM/Cryptech/

/etc/opendnssec/zonelist.xml:

<Zone name="example.com">
        <Policy>lab</Policy>
        <SignerConfiguration>/var/lib/opendnssec/signconf/example.com.xml</SignerConfiguration>
        <Adapters>
                <Input>
                        <Adapter type="File">/var/lib/opendnssec/unsigned/example.com</Adapter>
                </Input>
                <Output>
                        <Adapter type="File">/var/lib/opendnssec/signed/example.com</Adapter>
                </Output>
        </Adapters>
</Zone>

Initialization and signing

Make the deamons reload their configuration:

    service opendnssec-enforcer restart
    service opendnssec-signer restart

Initialize opendnssec:

    ods-ksmutil setup

That should be it!

See /var/log/syslog for output from ods-kaspcheck, ods-enforcerd and ods-signerd. See /var/lib/opendnssec/signed/ for a signed example.com zone.

To list keys using ods-ksmutil, accessing the HSM using pkcs11 directly (rather than going through any of the opendnssec daemons), export the environment variables from /etc/default/opendnssec and run "ods-ksmutil keys list --verbose":

# ods-ksmutil keys list --verbose
SQLite database set to: /var/lib/opendnssec/kasp.db
Keys:
Zone:                           Keytype:      State:    Date of next transition (to):  Size:   Algorithm:  CKA_ID:                           Repository:                       Keytag:
example.com                     KSK           ready     waiting for ds-seen (active)   2048    8           7f9b9329480ebe5dc81054ccb293e261  Cryptech                          62642
example.com                     ZSK           active    2016-07-13 19:04:30 (retire)   1024    8           97e972633613bd605944a0531ff5399b  Cryptech                          56620

If the output for repository is "Cryptech NOT IN repository", ods-ksmutil has not been able to actually list the keys in the HSM.

Cryptech Project - DNSSEC

DNSSEC/Requirements

DNSSEC Requirements

Questions

Must implement

Should implement

May implement

DNSSEC

DNSSEC signing using OpenDNSSEC and a Cryptech alpha board rev03

Before you start, you'll need

Configure the HSM

Configure OpenDNSSEC

OpenDNSSEC configuration changes

Initialization and signing