[dns-operations] Surprisingly large cluster of domains sharing the same pair of 512-bit ZSKs and some more RSA key oddities
Viktor Dukhovni
ietf-dane at dukhovni.org
Mon Oct 30 12:49:22 UTC 2017
Looking closely at the data gathered by the DANE survey I've
run into more than 54 thousand (!!!) domains that have the same
pair of 512-bit RSA keys for their ZSKs. A small sample follows
my signature. The SOA records all point at wedos.cz, who appear
to be some sort of hosting provider. Perhaps someone native to
.CZ could reach out to them and suggest that 512-bit keys are no
longer a good idea, especially if re-used so liberally!
The only sensible feature of these is that the exponent is the
usual F_4. Two domains unrelated to the above have 512-bit keys
with a weak exponent of 3:
trt12.jus.br
trt12.gov.br
More broadly, the DNSKEY length (including exponent length and exponent)
histogram (distinct RR count) for keys for algorithms 5, 7, 8 and 10 (RSA)
is below, with some highlights annotated. It seems too many folks
stray into uncharted waters with their DNSKEY parameter choices. Perhaps
the key management tools should offer them less rope...
RR count | length
---------+--------
2 | 66 (512-bit keys with expontent 3)
130395 | 68 (512-bit keys, mostly the wedos.cz domains)
7 | 70
27 | 100 (768-bit keys)
1 | 117
1 | 122
1 | 124
141 | 130 (1024-bit with exponent 3)
107 | 131 (1024-bit with exponent 65337 == 3*29*751)
6282427 | 132 (1024-bit keys)
647 | 133 (1024-bit keys with exponent 2^30 + 3, prime)
1983 | 134 (1024-bit keys with exponent 2^32 + 1 == 641 * 6700417)
99 | 135
1 | 139
2 | 146
99 | 148
2 | 149
2 | 160
7 | 162
196633 | 164 (1280-bit keys)
113 | 167
6 | 168
97 | 169
19 | 173
6 | 179
190377 | 196 (1536-bit keys)
37 | 198
1 | 207
1 | 216
1 | 222
1 | 229
1 | 232
1 | 233
2 | 240
1 | 241
1 | 245
1 | 249
1 | 252
1 | 254
6 | 256
13 | 257
488 | 258
96 | 259
2881881 | 260 (2048-bit keys)
21 | 261
2112 | 262
24 | 265
1 | 266
4 | 268
1 | 269
93 | 292
2 | 294
3 | 308
2 | 314
377 | 324
60 | 388
2 | 391
3 | 410
56204 | 516 (4096-bit keys)
9744 | 518
2 | 1028 (8192-bit keys)
--
Viktor.
zuszacler.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zuszacler.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zusvoborskeho.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zusvoborskeho.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zusvb.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zusvb.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zustatek.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zustatek.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zusricany.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zusricany.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zusrakovnik.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zusrakovnik.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zuspraha9.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zuspraha9.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zuspraha7.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zuspraha7.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zusodry.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zusodry.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zusmyto.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zusmyto.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zusmt.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zusmt.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zusmkrumlov.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zusmkrumlov.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zuslomnice.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zuslomnice.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zuslitovel.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zuslitovel.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zuslibcice.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zuslibcice.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zusjevicko.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zusjevicko.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zushodonin.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zushodonin.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
zushlinsko.cz. DNSKEY 256 3 7 AwEAAcAXIKWA1mNC46kszpVNe2VRTja/bAdCjRW6WsTYjW8bwpu1SoKFYQH1zMOFnQ1OmYh1cbmZiuGx8G2ty5zLFgU=
zushlinsko.cz. DNSKEY 256 3 7 AwEAAdvMhUWgut59L3JgPVQDH9m+wfdM42Dz2iSWYny6KnrxWjhpSaf5GV7/9aL6EYHKhkjSGehECT1SdhyQhf+5MBU=
More information about the dns-operations
mailing list