python-3.xencryptiondnsrsadnssec

Creating valid RSA/SHA256 Key for DNSKEY Resource Record


I am writing DNS server on python and currently stuck with DNSKEY resource record for DNSSEC. According to RFC5702 RSA/SHA256 key components are:

Given a private key with the following values (in Base64):
Private-key-format: v1.2
Algorithm:       8 (RSASHA256)
Modulus:         wVwaxrHF2CK64aYKRUibLiH30KpPuPBjel7E8ZydQW1HYWHfoGm
                 idzC2RnhwCC293hCzw+TFR2nqn8OVSY5t2Q==
PublicExponent:  AQAB
PrivateExponent: UR44xX6zB3eaeyvTRzmskHADrPCmPWnr8dxsNwiDGHzrMKLN+i/
                 HAam+97HxIKVWNDH2ba9Mf1SA8xu9dcHZAQ==
Prime1:          4c8IvFu1AVXGWeFLLFh5vs7fbdzdC6U82fduE6KkSWk=
Prime2:          2zZpBE8ZXVnL74QjG4zINlDfH+EOEtjJJ3RtaYDugvE=
Exponent1:       G2xAPFfK0KGxGANDVNxd1K1c9wOmmJ51mGbzKFFNMFk=
Exponent2:       GYxP1Pa7CAwtHm8SAGX594qZVofOMhgd6YFCNyeVpKE=
Coefficient:     icQdNRjlZGPmuJm2TIadubcO8X7V4y07aVhX464tx8Q=

The DNSKEY record for this key would be:

example.net.     3600  IN  DNSKEY  (256 3 8 AwEAAcFcGsaxxdgiuuGmCkVI
                 my4h99CqT7jwY3pexPGcnUFtR2Fh36BponcwtkZ4cAgtvd4Qs8P
                 kxUdp6p/DlUmObdk= );{id = 9033 (zsk), size = 512b}

Using this example I am trying to get original key values by decoding base64 example values:

newkey_n = int.from_bytes(base64.b64decode('wVwaxrHF2CK64aYKRUibLiH30KpPuPBjel7E8ZydQW1HYWHfoGmidzC2RnhwCC293hCzw+TFR2nqn8OVSY5t2Q=='), byteorder='big')
newkey_e = int.from_bytes(base64.b64decode('AQAB'), byteorder='big')
newkey_d = int.from_bytes(base64.b64decode('UR44xX6zB3eaeyvTRzmskHADrPCmPWnr8dxsNwiDGHzrMKLN+i/HAam+97HxIKVWNDH2ba9Mf1SA8xu9dcHZAQ=='), byteorder='big')
newkey_p = int.from_bytes(base64.b64decode('4c8IvFu1AVXGWeFLLFh5vs7fbdzdC6U82fduE6KkSWk='), byteorder='big')
newkey_q = int.from_bytes(base64.b64decode('2zZpBE8ZXVnL74QjG4zINlDfH+EOEtjJJ3RtaYDugvE='), byteorder='big')
newkey_u = int.from_bytes(base64.b64decode('icQdNRjlZGPmuJm2TIadubcO8X7V4y07aVhX464tx8Q='), byteorder='big')
newkey_exp1 = int.from_bytes(base64.b64decode('G2xAPFfK0KGxGANDVNxd1K1c9wOmmJ51mGbzKFFNMFk='), byteorder='big')
newkey_exp2 = int.from_bytes(base64.b64decode('GYxP1Pa7CAwtHm8SAGX594qZVofOMhgd6YFCNyeVpKE='), byteorder='big')

After this I get all needed values to construct RSA key:

from Crypto.PublicKey import RSA
key = RSA.construct((newkey_n, newkey_e, newkey_d, newkey_p, newkey_q, newkey_u))

But receive an error:

ValueError: RSA factors do not match modulus

What am I doing wrong? It seems that RSA/SHA Key generation is pretty much undocumented or I wasn't able to find full docs. Will be glad to get any kind of help.


Solution

  • Found out an answer myself. Will post it if someone encounters this issue

    DNSKEY Public Key field composes of: Length of PublicExponent + PublicExponent + Modulus. So:

    import base64
    from bitstring import BitArray
    import math
    modulus = int.from_bytes(base64.b64decode('wVwaxrHF2CK64aYKRUibLiH30KpPuPBjel7E8ZydQW1HYWHfoGmidzC2RnhwCC293hCzw+TFR2nqn8OVSY5t2Q=='), byteorder='big')
    pe = int.from_bytes(base64.b64decode('AQAB'), byteorder='big')
    len_pe = format(math.ceil(len(format(pe, 'b')) / 8), 'b').zfill(8)
    pe = format(pe, 'b').zfill(8 * math.ceil(len(format(pe, 'b')) / 8))
    modulus = format(modulus, 'b').zfill(8 * math.ceil(len(format(modulus, 'b')) / 8))
    base64.b64encode(BitArray(bin=len_pe + pe + modulus).bytes)
    print(base64.b64encode(BitArray(bin=len_pe + pe + modulus).bytes))
    >> b'AwEAAcFcGsaxxdgiuuGmCkVImy4h99CqT7jwY3pexPGcnUFtR2Fh36BponcwtkZ4cAgtvd4Qs8PkxUdp6p/DlUmObdk='
    

    Result matches what example showed us