RFC 2539 (rfc2539) - Page 2 of 7

Storage of Diffie-Hellman Keys in the Domain Name System (DNS)

RFC 2539             Diffie-Hellman Keys in the DNS           March 1999


Table of Contents

   Abstract...................................................1
   Acknowledgements...........................................1
   1. Introduction............................................2
   1.1 About This Document....................................2
   1.2 About Diffie-Hellman...................................2
   2. Diffie-Hellman KEY Resource Records.....................3
   3. Performance Considerations..............................4
   4. IANA Considerations.....................................4
   5. Security Considerations.................................4
   References.................................................5
   Author's Address...........................................5
   Appendix A: Well known prime/generator pairs...............6
   A.1. Well-Known Group 1:  A 768 bit prime..................6
   A.2. Well-Known Group 2:  A 1024 bit prime.................6
   Full Copyright Notice......................................7

1. Introduction

   The Domain Name System (DNS) is the current global hierarchical
   replicated distributed database system for Internet addressing, mail
   proxy, and similar information. The DNS has been extended to include
   digital signatures and cryptographic keys as described in [RFC 2535].
   Thus the DNS can now be used for secure key distribution.

1.1 About This Document

   This document describes how to store Diffie-Hellman keys in the DNS.
   Familiarity with the Diffie-Hellman key exchange algorithm is assumed
   [Schneier].

1.2 About Diffie-Hellman

   Diffie-Hellman requires two parties to interact to derive keying
   information which can then be used for authentication.  Since DNS SIG
   RRs are primarily used as stored authenticators of zone information
   for many different resolvers, no Diffie-Hellman algorithm SIG RR is
   defined. For example, assume that two parties have local secrets "i"
   and "j".  Assume they each respectively calculate X and Y as follows:

                X = g**i ( mod p ) Y = g**j ( mod p )

   They exchange these quantities and then each calculates a Z as
   follows:

                Zi = Y**i ( mod p ) Zj = X**j ( mod p )




Eastlake                    Standards Track