[dns-operations] a maximum of about 16K possible DNSSEC keytags?

[Warren Kumari]

Yah, Duane is probably right.

I'm generating keys in sets of 2000, and deleting the keys after each set.
It does seem like the first few get generated quickly, and then it starts
to slow down over time, then goes quickly again when I (delete) and restart.

Generated 25209 keytags, with 13012 unique. Seeing as I've already burnt
the CPU time, I'll let it run for a bit more till I've passed the 16K
unique tags...

For those interested (not sure why you would be :-)) the distribution of
collisions looks like:

Count     Number of collisions
------------------------------------
      4 7
     46 6
    243 5
    783 4
   2088 3
   4446 2
   5402 1


So, 7 keytags have had 7 collisions, 6 have had 6, 243 have had 5, etc.

Perhaps, if I'm bored, I'll rerun this using /dev/random instead of
/dev/urandom to see if things look significantly different, but I'm
assuming they won't.

W

On Mon, Nov 30, 2015 at 11:54 AM Wessels, Duane <dwessels at verisign.com>
wrote:

> Roy,
>
> I think its because of the revoke bit.
>
> I did something similar once and found that dnssec-keygen won't generate a
> new
> key (for same name, in same dir) if:
>
>   - the new key tag conflicts with an existing key tag
>   - the new key tag conflicts with an existing key tag + revoke bit
>   - the new key tag + revoke bit conflicts with an existing key tag
>
> DW
>
>
> > On Nov 30, 2015, at 7:49 AM, Roy Arends <roy at dnss.ec> wrote:
> >
> > On 30 Nov 2015, at 15:34, Warren Kumari wrote:
> >
> >> ... and, for the last hour or so I've been generating lots of keys using
> >> ISC BIND dnssec-keygen.
> >>
> >> Currently I'm up to:
> >> wkumari at eric:~/tmp/tmp$ wc -l keytags
> >> 5209 keytags
> >> (and, boy, are my fingers tired...)
> >>
> >> How did you generate the keys? I've been doing:
> >> dnssec-keygen -K keys -a RSASHA256 -b 2048 -f KSK -v \
> >> 0 -r /dev/urandom example.com > /dev/null 2>&1
> >
> > while true; do /usr/local/sbin/dnssec-keygen -a rsasha256 -b 2048 -f KSK
> .; done
> >
> > to do an equivalent calculation with random numbers I use:
> >
> > while true; do jot -r 128 0 65535|awk '{s+=$1} END {print (s +
> int(s/65536))%65535}'>>test;done
> >
> > The former gets about 16K unique results, the latter 64K.
> >
> > Roy
> >
> >
> >>
> >> W
> >>
> >> On Mon, Nov 30, 2015 at 10:24 AM Roy Arends <roy at dnss.ec> wrote:
> >>
> >>> On 29 Nov 2015, at 23:20, Roy Arends wrote:
> >>>
> >>>> I am only able to generate about 16K unique keytags for a 2K RSASHA256
> >>>> KSK (*), even after generating hundreds of thousands of keys in a
> >>>> loop.
> >>>>
> >>>> I expected the entire 16 bit keytag space used (i.e. 64K keytags), as
> >>>> the keytag is simply the sum of the DNSKEY RDATA (as a series of two
> >>>> byte values) with the high two bytes of the resulting 32 bit value
> >>>> added to the low 2 byte without carry.
> >>>>
> >>>> Since the RDATA contains 256 bytes of modulus (a result of multiplying
> >>>> two randomly generated 128 byte primes), I thought it had a fair
> >>>> amount of entropy so that the resulting key tags would be nicely
> >>>> distributed.
> >>>>
> >>>> Apparently not.
> >>>>
> >>>> Anyone able (willing) to explain the math, please?
> >>>
> >>> Peter van Dijk generated a large set of DNSKEYs with the same
> algorithm,
> >>> flags and exponent and was able to generate a lot more unique keytags.
> >>> Peter is using PowerDNS ’pdnssec add-zone-key’ which uses mbedTLS
> >>> 2.1.0, while I was using dnssec-keygen and ldns-keygen which both used
> >>> OpenSSL 0.9.8zg.
> >>>
> >>> It looks like the difference stems from the libraries involved. At
> least
> >>> we can fingerprint the key generators behind the keys used :-)
> >>>
> >>> Not sure if I can find out more, or if this is important. Will keep
> >>> looking though.
> >>>
> >>> Thanks
> >>>
> >>> Roy
> >>> _______________________________________________
> >>> dns-operations mailing list
> >>> dns-operations at lists.dns-oarc.net
> >>> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> >>> dns-jobs
> >>> <https://lists.dns-oarc.net/mailman/listinfo/dns-operationsdns-jobs>
> >>> mailing list
> >>> https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
> > _______________________________________________
> > dns-operations mailing list
> > dns-operations at lists.dns-oarc.net
> > https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> > dns-jobs mailing list
> > https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
>
>
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> dns-jobs
> <https://lists.dns-oarc.net/mailman/listinfo/dns-operationsdns-jobs>
> mailing list
> https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20151130/63ac529a/attachment.html>