I am writing DNS server on python and currently stuck with DNSKEY resource record for DNSSEC. According to RFC5702 RSA/SHA256 key components are:
Given a private key with the following values (in Base64):
Private-key-format: v1.2
Algorithm: 8 (RSASHA256)
Modulus: wVwaxrHF2CK64aYKRUibLiH30KpPuPBjel7E8ZydQW1HYWHfoGm
idzC2RnhwCC293hCzw+TFR2nqn8OVSY5t2Q==
PublicExponent: AQAB
PrivateExponent: UR44xX6zB3eaeyvTRzmskHADrPCmPWnr8dxsNwiDGHzrMKLN+i/
HAam+97HxIKVWNDH2ba9Mf1SA8xu9dcHZAQ==
Prime1: 4c8IvFu1AVXGWeFLLFh5vs7fbdzdC6U82fduE6KkSWk=
Prime2: 2zZpBE8ZXVnL74QjG4zINlDfH+EOEtjJJ3RtaYDugvE=
Exponent1: G2xAPFfK0KGxGANDVNxd1K1c9wOmmJ51mGbzKFFNMFk=
Exponent2: GYxP1Pa7CAwtHm8SAGX594qZVofOMhgd6YFCNyeVpKE=
Coefficient: icQdNRjlZGPmuJm2TIadubcO8X7V4y07aVhX464tx8Q=
The DNSKEY record for this key would be:
example.net. 3600 IN DNSKEY (256 3 8 AwEAAcFcGsaxxdgiuuGmCkVI
my4h99CqT7jwY3pexPGcnUFtR2Fh36BponcwtkZ4cAgtvd4Qs8P
kxUdp6p/DlUmObdk= );{id = 9033 (zsk), size = 512b}
Using this example I am trying to get original key values by decoding base64 example values:
newkey_n = int.from_bytes(base64.b64decode('wVwaxrHF2CK64aYKRUibLiH30KpPuPBjel7E8ZydQW1HYWHfoGmidzC2RnhwCC293hCzw+TFR2nqn8OVSY5t2Q=='), byteorder='big')
newkey_e = int.from_bytes(base64.b64decode('AQAB'), byteorder='big')
newkey_d = int.from_bytes(base64.b64decode('UR44xX6zB3eaeyvTRzmskHADrPCmPWnr8dxsNwiDGHzrMKLN+i/HAam+97HxIKVWNDH2ba9Mf1SA8xu9dcHZAQ=='), byteorder='big')
newkey_p = int.from_bytes(base64.b64decode('4c8IvFu1AVXGWeFLLFh5vs7fbdzdC6U82fduE6KkSWk='), byteorder='big')
newkey_q = int.from_bytes(base64.b64decode('2zZpBE8ZXVnL74QjG4zINlDfH+EOEtjJJ3RtaYDugvE='), byteorder='big')
newkey_u = int.from_bytes(base64.b64decode('icQdNRjlZGPmuJm2TIadubcO8X7V4y07aVhX464tx8Q='), byteorder='big')
newkey_exp1 = int.from_bytes(base64.b64decode('G2xAPFfK0KGxGANDVNxd1K1c9wOmmJ51mGbzKFFNMFk='), byteorder='big')
newkey_exp2 = int.from_bytes(base64.b64decode('GYxP1Pa7CAwtHm8SAGX594qZVofOMhgd6YFCNyeVpKE='), byteorder='big')
After this I get all needed values to construct RSA key:
from Crypto.PublicKey import RSA
key = RSA.construct((newkey_n, newkey_e, newkey_d, newkey_p, newkey_q, newkey_u))
But receive an error:
ValueError: RSA factors do not match modulus
What am I doing wrong? It seems that RSA/SHA Key generation is pretty much undocumented or I wasn't able to find full docs. Will be glad to get any kind of help.
Found out an answer myself. Will post it if someone encounters this issue
DNSKEY Public Key field composes of: Length of PublicExponent + PublicExponent + Modulus. So:
import base64
from bitstring import BitArray
import math
modulus = int.from_bytes(base64.b64decode('wVwaxrHF2CK64aYKRUibLiH30KpPuPBjel7E8ZydQW1HYWHfoGmidzC2RnhwCC293hCzw+TFR2nqn8OVSY5t2Q=='), byteorder='big')
pe = int.from_bytes(base64.b64decode('AQAB'), byteorder='big')
len_pe = format(math.ceil(len(format(pe, 'b')) / 8), 'b').zfill(8)
pe = format(pe, 'b').zfill(8 * math.ceil(len(format(pe, 'b')) / 8))
modulus = format(modulus, 'b').zfill(8 * math.ceil(len(format(modulus, 'b')) / 8))
base64.b64encode(BitArray(bin=len_pe + pe + modulus).bytes)
print(base64.b64encode(BitArray(bin=len_pe + pe + modulus).bytes))
>> b'AwEAAcFcGsaxxdgiuuGmCkVImy4h99CqT7jwY3pexPGcnUFtR2Fh36BponcwtkZ4cAgtvd4Qs8PkxUdp6p/DlUmObdk='
Result matches what example showed us