7 ms·
Part of the reason small size keys like this are in common use is that bind (and possibly other name daemons) doesn't allow records larger than 255 characters.
by forkqueue 16y ago
Part of the reason small size keys like this are in common use is that bind (and possibly other name daemons) doesn't allow records larger than 255 characters. DKIM requires one to put the public key in DNS.
Earlier this week I set up DKIM, and initially tried and failed to use a 2048-bit key, because of this issue.
- jgrahamc 16y ago$ openssl genrsa -out private.key 1024 $ openssl rsa -in private.key -out public.key -pubout -outform PEM writing RSA key $ grep -v '^--' public.key | wc -c 220 So, 1024 bit key should be ok.
- maw 16y agoIt's not specific to bind: RFC 1035 says the following: 2.3.4. Size limits Various objects and parameters in the DNS have size limits. They are listed below. Some could be easily changed, others are more fundamental. labels 63 octets or less names 255 octets or less TTL positive values of a signed 32 bit number. UDP messages 512 octets or less Although if the response to a query doesn't fit, the TC bit is supposed to be set and clients should retry over TCP. This is rare enough in practice, though, that not all implementations bother.