Web Site

Domain-name-system.org

» Domain Name System » Topics begins with R » RRSIG resource record

Printer Friendly FormatPrinter Friendly Format
Bookmark page - RRSIG resource recordBookmark this page
Back to Domain Name SystemBack to "Domain Name System"
Page modified: Friday, June 23, 2006 20:29:01

With RRSIG resource record and/or Signature resource record can be signed in the framework by DNSSEC (DNS Security) arbitrary resource record digitally. The RRSIG type replaced 2004 the almost identical SIG resource record.

Background

A user, who receives to a DNS Request an answer (e.g. a IP address), cannot be not safe that the answer also really comes from a regular name server and that it was not falsified on the route of transportation. The solution is to sign resource record digitally.

A digital signature presupposes a publication IC key procedure. The name server, which is autoritativ as masters for an DNS entry, signs this with its private key. Resolvers can validate the digital signature at any time, if they know the public key of the zone.

Structure

A RRSIG resource record consists of the following fields:

Name of the digitally signed RRs

RRSIG (type 46)

Current TTL indicates, like for a long time this entry in the Cache to be held type of being allowed key of the signed RR - e.g. A, LV, (1=MD5,2=Diffie-Hellman, 3=DSA) number of name components for Wildcard dissolution - sees to RFC 2535TTL at the time the signature start time starting from that the signature valid istEndzeitpunkt up to that the signature valid isteindeutige number over between several signatures differentiating (English keys day) name of the signer (zone) actual signature

Example

In this example a A-RR is digitally signed:

www.child.ex ample. 1285 A 1.2.3.15 www.child.ex ample. 1285 RRSIG (A; Type is A-RR 3; DSA Encryption 3; Name has 3 components 1285; Original TTL 20040327122207; Start time 20040226122207; End-time 22004; clear number child.example. ; Name of the signer BMTLR80WnKndatr77OirBtprR9SLKoZUiPWX U5kViDi+5amYW/GFCp0=)

Related links

  • RFC 4033 - DNS Security Extension

Printer Friendly FormatPrinter Friendly Format
Back to topBack to top
Back to Domain Name SystemBack to "Domain Name System"
Back to topBack to top
Back to Domain Name SystemBack to "Domain Name System"

Related Websites

We found here 6 related websites.

Back to topBack to top
Back to Domain Name SystemBack to "Domain Name System"
Page cached: Wednesday, July 5, 2006 14:16:04
Valid XHTML 1.0!  Valid CSS!
Page copy protected against web site content infringement by Copyscape