org.xbill.DNS
Class DNSSEC

java.lang.Object
  extended by org.xbill.DNS.DNSSEC

public class DNSSEC
extends Object

Constants and methods relating to DNSSEC. DNSSEC provides authentication for DNS information.

Author:
Brian Wellington
See Also:
RRSIGRecord, DNSKEYRecord, RRset

Nested Class Summary
static class DNSSEC.Algorithm
           
static class DNSSEC.DNSSECException
          A DNSSEC exception.
static class DNSSEC.IncompatibleKeyException
          The key data provided is inconsistent.
static class DNSSEC.KeyMismatchException
          A DNSSEC verification failed because fields in the DNSKEY and RRSIG records do not match.
static class DNSSEC.MalformedKeyException
          The cryptographic data in a DNSSEC key is malformed.
static class DNSSEC.SignatureExpiredException
          A DNSSEC verification failed because the signature has expired.
static class DNSSEC.SignatureNotYetValidException
          A DNSSEC verification failed because the signature has not yet become valid.
static class DNSSEC.SignatureVerificationException
          A DNSSEC verification failed because the cryptographic signature verification failed.
static class DNSSEC.UnsupportedAlgorithmException
          An algorithm is unsupported by this DNSSEC implementation.
 
Method Summary
static byte[] digestMessage(SIGRecord sig, Message msg, byte[] previous)
          Creates a byte array containing the concatenation of the fields of the SIG(0) record and the message to be signed.
static byte[] digestRRset(RRSIGRecord rrsig, RRset rrset)
          Creates a byte array containing the concatenation of the fields of the SIG record and the RRsets to be signed/verified.
static RRSIGRecord sign(RRset rrset, DNSKEYRecord key, PrivateKey privkey, Date inception, Date expiration)
          Generate a DNSSEC signature.
static void verify(RRset rrset, RRSIGRecord rrsig, DNSKEYRecord key)
          Verify a DNSSEC signature.
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Method Detail

digestRRset

public static byte[] digestRRset(RRSIGRecord rrsig,
                                 RRset rrset)
Creates a byte array containing the concatenation of the fields of the SIG record and the RRsets to be signed/verified. This does not perform a cryptographic digest.

Parameters:
rrsig - The RRSIG record used to sign/verify the rrset.
rrset - The data to be signed/verified.
Returns:
The data to be cryptographically signed or verified.

digestMessage

public static byte[] digestMessage(SIGRecord sig,
                                   Message msg,
                                   byte[] previous)
Creates a byte array containing the concatenation of the fields of the SIG(0) record and the message to be signed. This does not perform a cryptographic digest.

Parameters:
sig - The SIG record used to sign the rrset.
msg - The message to be signed.
previous - If this is a response, the signature from the query.
Returns:
The data to be cryptographically signed.

verify

public static void verify(RRset rrset,
                          RRSIGRecord rrsig,
                          DNSKEYRecord key)
                   throws DNSSEC.DNSSECException
Verify a DNSSEC signature.

Parameters:
rrset - The data to be verified.
rrsig - The RRSIG record containing the signature.
key - The DNSKEY record to verify the signature with.
Throws:
DNSSEC.UnsupportedAlgorithmException - The algorithm is unknown
DNSSEC.MalformedKeyException - The key is malformed
DNSSEC.KeyMismatchException - The key and signature do not match
DNSSEC.SignatureExpiredException - The signature has expired
DNSSEC.SignatureNotYetValidException - The signature is not yet valid
DNSSEC.SignatureVerificationException - The signature does not verify.
DNSSEC.DNSSECException - Some other error occurred.

sign

public static RRSIGRecord sign(RRset rrset,
                               DNSKEYRecord key,
                               PrivateKey privkey,
                               Date inception,
                               Date expiration)
                        throws DNSSEC.DNSSECException
Generate a DNSSEC signature. key and privateKey must refer to the same underlying cryptographic key.

Parameters:
rrset - The data to be signed
key - The DNSKEY record to use as part of signing
privkey - The PrivateKey to use when signing
inception - The time at which the signatures should become valid
expiration - The time at which the signatures should expire
Returns:
The generated signature
Throws:
DNSSEC.UnsupportedAlgorithmException - The algorithm is unknown
DNSSEC.MalformedKeyException - The key is malformed
DNSSEC.DNSSECException - Some other error occurred.