public class DNSSEC
extends java.lang.Object
DNSSEC provides authentication for DNS information.
RRSIGRecord
,
DNSKEYRecord
,
RRset
Modifier and Type | Class and Description |
---|---|
static class |
DNSSEC.Algorithm
Domain Name System Security (DNSSEC) Algorithm Numbers.
|
static class |
DNSSEC.Digest
DNSSEC Delegation Signer (DS) Resource Record (RR) Type Digest Algorithms.
|
static class |
DNSSEC.DNSSECException
A DNSSEC exception.
|
private static class |
DNSSEC.ECKeyInfo |
static class |
DNSSEC.IncompatibleKeyException
The key data provided is inconsistent.
|
static class |
DNSSEC.KeyMismatchException
A DNSSEC verification failed because fields in the DNSKEY and RRSIG records do not match.
|
static class |
DNSSEC.MalformedKeyException
The cryptographic data in a DNSSEC key is malformed.
|
static class |
DNSSEC.NoSignatureException
No signature was found.
|
static class |
DNSSEC.SignatureExpiredException
A DNSSEC verification failed because the signature has expired.
|
static class |
DNSSEC.SignatureNotYetValidException
A DNSSEC verification failed because the signature has not yet become valid.
|
static class |
DNSSEC.SignatureVerificationException
A DNSSEC verification failed because the cryptographic signature verification failed.
|
static class |
DNSSEC.UnsupportedAlgorithmException
An algorithm is unsupported by this DNSSEC implementation.
|
Modifier and Type | Field and Description |
---|---|
(package private) static int |
ASN1_BITSTRING |
(package private) static int |
ASN1_INT |
(package private) static int |
ASN1_OID |
(package private) static int |
ASN1_SEQ |
private static int |
DSA_LEN |
private static DNSSEC.ECKeyInfo |
ECDSA_P256 |
private static DNSSEC.ECKeyInfo |
ECDSA_P384 |
private static DNSSEC.ECKeyInfo |
GOST |
Modifier | Constructor and Description |
---|---|
private |
DNSSEC() |
Modifier and Type | Method and Description |
---|---|
static java.lang.String |
algString(int alg)
Convert an algorithm number to the corresponding JCA string.
|
private static java.io.IOException |
asn1ParseException(java.lang.Object expected,
java.lang.Object actual) |
private static int |
bigIntegerLength(java.math.BigInteger i) |
(package private) static void |
checkAlgorithm(java.security.PrivateKey key,
int alg) |
static byte[] |
digestMessage(SIGRecord sig,
Message msg,
byte[] previous)
Creates a byte array containing the concatenation of the fields of the SIG(0) record and the
message to be signed.
|
static byte[] |
digestRRset(RRSIGRecord rrsig,
RRset rrset)
Creates a byte array containing the concatenation of the fields of the SIG record and the
RRsets to be signed/verified.
|
private static void |
digestSIG(DNSOutput out,
SIGBase sig) |
private static byte[] |
dsaSignatureFromDNS(byte[] signature,
int keyLength,
boolean skipT) |
private static byte[] |
dsaSignatureToDNS(byte[] signature,
int rsLen,
int t) |
private static byte[] |
fromDSAPublicKey(java.security.interfaces.DSAPublicKey key) |
private static byte[] |
fromECDSAPublicKey(java.security.interfaces.ECPublicKey key,
DNSSEC.ECKeyInfo keyinfo) |
private static byte[] |
fromECGOSTPublicKey(java.security.interfaces.ECPublicKey key,
DNSSEC.ECKeyInfo keyinfo) |
private static byte[] |
fromEdDSAPublicKey(java.security.PublicKey key) |
(package private) static byte[] |
fromPublicKey(java.security.PublicKey key,
int alg)
Builds a DNSKEY record from a PublicKey
|
private static byte[] |
fromRSAPublicKey(java.security.interfaces.RSAPublicKey key) |
(package private) static byte[] |
generateDSDigest(DNSKEYRecord key,
int digestid)
Generate the digest value for a DS key
|
private static int |
getDsaIntLen(byte[] bigint,
int dsaLen) |
private static boolean |
matches(SIGBase sig,
KEYBase key) |
private static java.math.BigInteger |
readBigInteger(DNSInput in) |
private static java.math.BigInteger |
readBigInteger(DNSInput in,
int len) |
private static java.math.BigInteger |
readBigIntegerLittleEndian(DNSInput in,
int len) |
private static void |
reverseByteArray(byte[] array) |
(package private) static byte[] |
sign(java.security.PrivateKey privkey,
java.security.PublicKey pubkey,
int alg,
byte[] data,
java.lang.String provider) |
static RRSIGRecord |
sign(RRset rrset,
DNSKEYRecord key,
java.security.PrivateKey privkey,
java.util.Date inception,
java.util.Date expiration)
Deprecated.
|
static RRSIGRecord |
sign(RRset rrset,
DNSKEYRecord key,
java.security.PrivateKey privkey,
java.util.Date inception,
java.util.Date expiration,
java.lang.String provider)
Deprecated.
|
static RRSIGRecord |
sign(RRset rrset,
DNSKEYRecord key,
java.security.PrivateKey privkey,
java.time.Instant inception,
java.time.Instant expiration)
Generate a DNSSEC signature.
|
static RRSIGRecord |
sign(RRset rrset,
DNSKEYRecord key,
java.security.PrivateKey privkey,
java.time.Instant inception,
java.time.Instant expiration,
java.lang.String provider)
Generate a DNSSEC signature.
|
(package private) static SIGRecord |
signMessage(Message message,
SIGRecord previous,
KEYRecord key,
java.security.PrivateKey privkey,
java.time.Instant inception,
java.time.Instant expiration) |
private static java.security.PublicKey |
toDSAPublicKey(byte[] key) |
private static java.security.PublicKey |
toECDSAPublicKey(byte[] key,
DNSSEC.ECKeyInfo keyinfo) |
private static java.security.PublicKey |
toECGOSTPublicKey(byte[] key,
DNSSEC.ECKeyInfo keyinfo) |
private static java.security.PublicKey |
toEdDSAPublicKey(byte[] key,
byte algId) |
(package private) static java.security.PublicKey |
toPublicKey(int alg,
byte[] key,
Record r)
Converts a KEY/DNSKEY record into a PublicKey
|
(package private) static java.security.PublicKey |
toPublicKey(KEYBase r)
Converts a KEY/DNSKEY record into a PublicKey
|
private static java.security.PublicKey |
toRSAPublicKey(byte[] key) |
private static void |
transformAns1IntToDns(int rsLen,
DNSInput in,
DNSOutput out) |
private static byte[] |
trimByteArray(byte[] array) |
private static void |
verify(java.security.PublicKey key,
int alg,
byte[] data,
byte[] signature) |
static void |
verify(RRset rrset,
RRSIGRecord rrsig,
DNSKEYRecord key)
Verify a DNSSEC signature.
|
static void |
verify(RRset rrset,
RRSIGRecord rrsig,
DNSKEYRecord key,
java.util.Date date)
Deprecated.
|
static void |
verify(RRset rrset,
RRSIGRecord rrsig,
DNSKEYRecord key,
java.time.Instant date)
Verify a DNSSEC signature.
|
(package private) static void |
verifyMessage(Message message,
byte[] bytes,
SIGRecord sig,
SIGRecord previous,
KEYRecord key,
java.time.Instant now) |
private static void |
writeAsn1Int(int keyLength,
DNSOutput out,
byte[] bigint,
int bigintLen) |
private static void |
writeBigInteger(DNSOutput out,
java.math.BigInteger val) |
private static void |
writePaddedBigInteger(DNSOutput out,
java.math.BigInteger val,
int len) |
private static void |
writePaddedBigIntegerLittleEndian(DNSOutput out,
java.math.BigInteger val,
int len) |
private static final DNSSEC.ECKeyInfo GOST
private static final DNSSEC.ECKeyInfo ECDSA_P256
private static final DNSSEC.ECKeyInfo ECDSA_P384
static final int ASN1_SEQ
static final int ASN1_INT
static final int ASN1_BITSTRING
static final int ASN1_OID
private static final int DSA_LEN
public static byte[] digestRRset(RRSIGRecord rrsig, RRset rrset)
rrsig
- The RRSIG record used to sign/verify the rrset.rrset
- The data to be signed/verified.public static byte[] digestMessage(SIGRecord sig, Message msg, byte[] previous)
sig
- The SIG record used to sign the rrset.msg
- The message to be signed.previous
- If this is a response, the signature from the query.private static int bigIntegerLength(java.math.BigInteger i)
private static java.math.BigInteger readBigInteger(DNSInput in, int len) throws java.io.IOException
java.io.IOException
private static java.math.BigInteger readBigInteger(DNSInput in)
private static byte[] trimByteArray(byte[] array)
private static void reverseByteArray(byte[] array)
private static java.math.BigInteger readBigIntegerLittleEndian(DNSInput in, int len) throws java.io.IOException
java.io.IOException
private static void writeBigInteger(DNSOutput out, java.math.BigInteger val)
private static void writePaddedBigInteger(DNSOutput out, java.math.BigInteger val, int len)
private static void writePaddedBigIntegerLittleEndian(DNSOutput out, java.math.BigInteger val, int len)
private static java.security.PublicKey toRSAPublicKey(byte[] key) throws java.io.IOException, java.security.GeneralSecurityException
java.io.IOException
java.security.GeneralSecurityException
private static java.security.PublicKey toDSAPublicKey(byte[] key) throws java.io.IOException, java.security.GeneralSecurityException, DNSSEC.MalformedKeyException
java.io.IOException
java.security.GeneralSecurityException
DNSSEC.MalformedKeyException
private static java.security.PublicKey toECGOSTPublicKey(byte[] key, DNSSEC.ECKeyInfo keyinfo) throws java.io.IOException, java.security.GeneralSecurityException
java.io.IOException
java.security.GeneralSecurityException
private static java.security.PublicKey toECDSAPublicKey(byte[] key, DNSSEC.ECKeyInfo keyinfo) throws java.io.IOException, java.security.GeneralSecurityException
java.io.IOException
java.security.GeneralSecurityException
private static java.security.PublicKey toEdDSAPublicKey(byte[] key, byte algId) throws java.security.GeneralSecurityException
java.security.GeneralSecurityException
static java.security.PublicKey toPublicKey(KEYBase r) throws DNSSEC.DNSSECException
DNSSEC.DNSSECException
static java.security.PublicKey toPublicKey(int alg, byte[] key, Record r) throws DNSSEC.DNSSECException
DNSSEC.DNSSECException
private static byte[] fromRSAPublicKey(java.security.interfaces.RSAPublicKey key)
private static byte[] fromDSAPublicKey(java.security.interfaces.DSAPublicKey key)
private static byte[] fromECGOSTPublicKey(java.security.interfaces.ECPublicKey key, DNSSEC.ECKeyInfo keyinfo)
private static byte[] fromECDSAPublicKey(java.security.interfaces.ECPublicKey key, DNSSEC.ECKeyInfo keyinfo)
private static byte[] fromEdDSAPublicKey(java.security.PublicKey key)
static byte[] fromPublicKey(java.security.PublicKey key, int alg) throws DNSSEC.DNSSECException
DNSSEC.DNSSECException
public static java.lang.String algString(int alg) throws DNSSEC.UnsupportedAlgorithmException
alg
- The algorithm number.DNSSEC.UnsupportedAlgorithmException
- The algorithm is unknown.private static java.io.IOException asn1ParseException(java.lang.Object expected, java.lang.Object actual)
private static byte[] dsaSignatureFromDNS(byte[] signature, int keyLength, boolean skipT) throws DNSSEC.DNSSECException, java.io.IOException
DNSSEC.DNSSECException
java.io.IOException
private static int getDsaIntLen(byte[] bigint, int dsaLen)
private static void writeAsn1Int(int keyLength, DNSOutput out, byte[] bigint, int bigintLen)
private static byte[] dsaSignatureToDNS(byte[] signature, int rsLen, int t) throws java.io.IOException
java.io.IOException
private static void transformAns1IntToDns(int rsLen, DNSInput in, DNSOutput out) throws java.io.IOException
java.io.IOException
private static void verify(java.security.PublicKey key, int alg, byte[] data, byte[] signature) throws DNSSEC.DNSSECException
DNSSEC.DNSSECException
public static void verify(RRset rrset, RRSIGRecord rrsig, DNSKEYRecord key) throws DNSSEC.DNSSECException
rrset
- The data to be verified.rrsig
- The RRSIG record containing the signature.key
- The DNSKEY record to verify the signature with.DNSSEC.UnsupportedAlgorithmException
- The algorithm is unknownDNSSEC.MalformedKeyException
- The key is malformedDNSSEC.KeyMismatchException
- The key and signature do not matchDNSSEC.SignatureExpiredException
- The signature has expiredDNSSEC.SignatureNotYetValidException
- The signature is not yet validDNSSEC.SignatureVerificationException
- The signature does not verify.DNSSEC.DNSSECException
- Some other error occurred.@Deprecated public static void verify(RRset rrset, RRSIGRecord rrsig, DNSKEYRecord key, java.util.Date date) throws DNSSEC.DNSSECException
verify(RRset, RRSIGRecord, DNSKEYRecord, Instant)
rrset
- The data to be verified.rrsig
- The RRSIG record containing the signature.key
- The DNSKEY record to verify the signature with.date
- The date against which the signature is verified.DNSSEC.UnsupportedAlgorithmException
- The algorithm is unknownDNSSEC.MalformedKeyException
- The key is malformedDNSSEC.KeyMismatchException
- The key and signature do not matchDNSSEC.SignatureExpiredException
- The signature has expiredDNSSEC.SignatureNotYetValidException
- The signature is not yet validDNSSEC.SignatureVerificationException
- The signature does not verify.DNSSEC.DNSSECException
- Some other error occurred.public static void verify(RRset rrset, RRSIGRecord rrsig, DNSKEYRecord key, java.time.Instant date) throws DNSSEC.DNSSECException
rrset
- The data to be verified.rrsig
- The RRSIG record containing the signature.key
- The DNSKEY record to verify the signature with.date
- The date against which the signature is verified.DNSSEC.UnsupportedAlgorithmException
- The algorithm is unknownDNSSEC.MalformedKeyException
- The key is malformedDNSSEC.KeyMismatchException
- The key and signature do not matchDNSSEC.SignatureExpiredException
- The signature has expiredDNSSEC.SignatureNotYetValidException
- The signature is not yet validDNSSEC.SignatureVerificationException
- The signature does not verify.DNSSEC.DNSSECException
- Some other error occurred.static byte[] sign(java.security.PrivateKey privkey, java.security.PublicKey pubkey, int alg, byte[] data, java.lang.String provider) throws DNSSEC.DNSSECException
DNSSEC.DNSSECException
static void checkAlgorithm(java.security.PrivateKey key, int alg) throws DNSSEC.UnsupportedAlgorithmException
@Deprecated public static RRSIGRecord sign(RRset rrset, DNSKEYRecord key, java.security.PrivateKey privkey, java.util.Date inception, java.util.Date expiration) throws DNSSEC.DNSSECException
sign(RRset, DNSKEYRecord, PrivateKey, Instant, Instant)
rrset
- The data to be signedkey
- The DNSKEY record to use as part of signingprivkey
- The PrivateKey to use when signinginception
- The time at which the signatures should become validexpiration
- The time at which the signatures should expireDNSSEC.UnsupportedAlgorithmException
- The algorithm is unknownDNSSEC.MalformedKeyException
- The key is malformedDNSSEC.DNSSECException
- Some other error occurred.@Deprecated public static RRSIGRecord sign(RRset rrset, DNSKEYRecord key, java.security.PrivateKey privkey, java.util.Date inception, java.util.Date expiration, java.lang.String provider) throws DNSSEC.DNSSECException
sign(RRset, DNSKEYRecord, PrivateKey, Instant, Instant, String)
rrset
- The data to be signedkey
- The DNSKEY record to use as part of signingprivkey
- The PrivateKey to use when signinginception
- The time at which the signatures should become validexpiration
- The time at which the signatures should expireDNSSEC.UnsupportedAlgorithmException
- The algorithm is unknownDNSSEC.MalformedKeyException
- The key is malformedDNSSEC.DNSSECException
- Some other error occurred.public static RRSIGRecord sign(RRset rrset, DNSKEYRecord key, java.security.PrivateKey privkey, java.time.Instant inception, java.time.Instant expiration) throws DNSSEC.DNSSECException
rrset
- The data to be signedkey
- The DNSKEY record to use as part of signingprivkey
- The PrivateKey to use when signinginception
- The time at which the signatures should become validexpiration
- The time at which the signatures should expireDNSSEC.UnsupportedAlgorithmException
- The algorithm is unknownDNSSEC.MalformedKeyException
- The key is malformedDNSSEC.DNSSECException
- Some other error occurred.public static RRSIGRecord sign(RRset rrset, DNSKEYRecord key, java.security.PrivateKey privkey, java.time.Instant inception, java.time.Instant expiration, java.lang.String provider) throws DNSSEC.DNSSECException
rrset
- The data to be signedkey
- The DNSKEY record to use as part of signingprivkey
- The PrivateKey to use when signinginception
- The time at which the signatures should become validexpiration
- The time at which the signatures should expireprovider
- The name of the JCA provider. If non-null, it will be passed to JCA
getInstance() methods.DNSSEC.UnsupportedAlgorithmException
- The algorithm is unknownDNSSEC.MalformedKeyException
- The key is malformedDNSSEC.DNSSECException
- Some other error occurred.static SIGRecord signMessage(Message message, SIGRecord previous, KEYRecord key, java.security.PrivateKey privkey, java.time.Instant inception, java.time.Instant expiration) throws DNSSEC.DNSSECException
DNSSEC.DNSSECException
static void verifyMessage(Message message, byte[] bytes, SIGRecord sig, SIGRecord previous, KEYRecord key, java.time.Instant now) throws DNSSEC.DNSSECException
DNSSEC.DNSSECException
static byte[] generateDSDigest(DNSKEYRecord key, int digestid)
key
- Which is covered by the DS recorddigestid
- The type of digest