Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

2048-bit RSA SHA256 keys are not fully supported #27

Open
GertjanBijl opened this issue Jan 4, 2022 · 1 comment · May be fixed by #51
Open

2048-bit RSA SHA256 keys are not fully supported #27

GertjanBijl opened this issue Jan 4, 2022 · 1 comment · May be fixed by #51

Comments

@GertjanBijl
Copy link

We use 2048-bit RSA SHA256 keys for DKIM, and we run into the issue that the txt-file containing the public-key is not useful for us.

I see that the public-key erb is pretty straight-forward, but it results in a faulty result when a 2048-bit key is used, since BIND cannot handle records longer than 255 bytes. It needs to be split up like:

someselector._domainkey    IN      TXT     ( "v=DKIM1; k=rsa; "
          "p=MII..6C"
          "Ga..AB" )

Also, when creating keys using the SHA256 hash, the hash-type should be included into the record, which is currently not possible.
When creation takes place with the following command:
/usr/sbin/opendkim-genkey -b 2048 --hash-algorithms=sha256 -D /etc/opendkim/keys/<domain> -d <domain> -s <selector>
we need the DNS-record to look like:

someselector._domainkey    IN      TXT     ( "v=DKIM1; h=sha256; k=rsa; "
          "p=MII..6C"
          "Ga..AB" )

Since this file is not really doing anything for the OpenDKIM process itself, it would also be an option not to manage this file at all, so I can optionally create and manage it myself outside the module, for example with a publickey_manage boolean or by making the public key optional.
The nicest way would be to be able to optionally define a hash type. As far as I know sha1 is the default when not defined.

SHA1 for DKIM is considered obsolete per RFC8301 and must not be used anymore. In the same document is stated that "Signers SHOULD use RSA keys of at least 2048 bits."

timdeluxe added a commit to dodevops/puppet-opendkim that referenced this issue Oct 4, 2022
timdeluxe added a commit to dodevops/puppet-opendkim that referenced this issue Oct 4, 2022
timdeluxe added a commit to dodevops/puppet-opendkim that referenced this issue Oct 4, 2022
@cruelsmith cruelsmith linked a pull request Jun 16, 2024 that will close this issue
@cruelsmith
Copy link
Contributor

#31 added the support to set the hash-type and also an not so nice way via publickeyextended for longer keys.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants