1

Why is it unsafe to use the DNSSEC algorithm RSA/MD5? In practical terms, how is DNSSEC weakened by the use of an algorithm such as MD5, which has a known weakness of collisions?

RFC 6944 states, under chapter 2.3 DNSSEC Implementation Status Table: "Implementation status: Must Not Implement" about RSA/MD5.

Furthermore the RFC states:

4. Security Considerations

This document lists, and in some cases assigns, the implementation status of cryptographic algorithms used with DNSSEC. It is not meant to be a discussion on algorithm superiority. No new security considerations are raised in this document, though prior description of algorithms as NOT RECOMMENDED (see [RFC4034]) has been recast as Must Not Implement.

Improve this question
3
  • "RSAMD5 has an implementation status of Must Not Implement because of known weaknesses in MD5." Don't we already have a lot of posts here about the weaknesses of MD5?
    – Arminius
    Apr 12, 2017 at 17:34
  • @Arminius we have and the weaknesses of MD5 is known. Collisions. But, I mean how will this practically work in case of MD5? Only when you find a collision you can "fake" a signature? I don't see yet how this practically work on DNSSEC.
    – Bob Ortiz
    Apr 12, 2017 at 17:40
  • @gowenfawr thanks for clearing the question up! Exactly what I meant.
    – Bob Ortiz
    Apr 12, 2017 at 19:14

2 Answers 2

Reset to default
2

This is still a matter of debate, see for example recently: https://www.ietf.org/mail-archive/web/dnsop/current/msg19820.html (and https://www.ietf.org/mail-archive/web/dnsop/current/msg19868.html ) In the sense that there is no known public attack against DNSSEC that is based on MD5 weaknesses (or SHA1 for that matter).

However, the IETF has clearly said that MD5 should not be used anymore, see RFC6151 :

MD5 is no longer acceptable where collision resistance is required such as digital signatures. It is not urgent to stop using MD5 in other ways, such as HMAC-MD5; however, since MD5 must not be used for digital signatures, new protocol designs should not employ HMAC-MD5.

For example, since the DS record is an hash of the key, if an attacker can construct a new key with the same hash as an existing DNSKEY in the zone, he would be able to deliver falsified but correctly DNSSEC-signed records.

Improve this answer
1

Not the cryptographic answer you were looking for, but: precisely because it is listed as Must Not Implement, many validators in fact do not implement it. This means that zones signed with RSA/MD5 will be treated as unsigned, and as a result your signing is useless.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .