java.lang.Object
org.minidns.record.Data
org.minidns.record.DNSKEY
public class DNSKEYextends Data
DNS DNSKEY record payload for DNSSEC public keys.
Contains a DNSSEC public key used to verify DNSSEC signatures for a DNS zone.

  • Field Details

    • FLAG_SECURE_ENTRY_POINT

      public static final short FLAG_SECURE_ENTRY_POINT
      Whether the key should be used as a secure entry point key. see RFC 3757
      See Also:

    • FLAG_REVOKE

      public static final short FLAG_REVOKE
      Whether the record holds a revoked key.
      See Also:

    • FLAG_ZONE

      public static final short FLAG_ZONE
      Whether the record holds a DNS zone key.
      See Also:

    • PROTOCOL_RFC4034

      public static final byte PROTOCOL_RFC4034
      Use the protocol defined in RFC 4034.
      See Also:

    • flags

      public final short flags
      Bitmap of flags: FLAG_SECURE_ENTRY_POINT, FLAG_REVOKE, FLAG_ZONE.
      See Also:

    • protocol

      public final byte protocol
      Must be PROTOCOL_RFC4034.

    • algorithm

      public final DnssecConstants.SignatureAlgorithm algorithm
      The public key's cryptographic algorithm used.

    • algorithmByte

      public final byte algorithmByte
      The byte value of the public key's cryptographic algorithm used.

    • key

      private final byte[] key
      The public key material. The format depends on the algorithm of the key being stored.

    • keyTag

      private transient Integer keyTag
      This DNSKEY's key tag. Calculated just-in-time when using getKeyTag()

    • keyBase64Cache

      private transient String keyBase64Cache
      Cache of the key in Base 64.

    • keyBigIntegerCache

      private transient BigInteger keyBigIntegerCache
      Cache of the key as a number.

  • Constructor Details

    • DNSKEY

      private DNSKEY(short flags, byte protocol, DnssecConstants.SignatureAlgorithm algorithm, byte algorithmByte, byte[] key)
      Creates a record from its parts.
      Parameters:
      flags - the flags of the key
      protocol - the protocol of the key, always dnssec
      algorithm - the signature algorithm
      algorithmByte - the wire value of the algorithm
      key - the key material

    • DNSKEY

      public DNSKEY(short flags, byte protocol, byte algorithm, byte[] key)
      Create a record from the raw algorithm number rather than a SignatureAlgorithm.
      Parameters:
      flags - the DNSKEY flags bitmap
      protocol - must be PROTOCOL_RFC4034
      algorithm - the algorithm number as it appears on the wire
      key - the public key material, formatted per the algorithm

    • DNSKEY

      public DNSKEY(short flags, byte protocol, DnssecConstants.SignatureAlgorithm algorithm, byte[] key)
      Create a record from a SignatureAlgorithm.
      Parameters:
      flags - the DNSKEY flags bitmap
      protocol - must be PROTOCOL_RFC4034
      algorithm - the public key's cryptographic algorithm
      key - the public key material, formatted per the algorithm

  • Method Details

    • parse

      public static DNSKEY parse(DataInputStream dis, int length) throws IOException
      Parse a DNSKEY record from the wire format.
      Parameters:
      dis - the stream positioned at the start of the record payload
      length - the size of the record in bytes, including the 4 byte flags, protocol and algorithm preamble
      Returns:
      the parsed record
      Throws:
      IOException - if length is under 4, or the stream ends before the key material is complete

    • getType

      public Record.TYPE getType()
      Record type of this record.
      Specified by:
      getType in class Data
      Returns:
      Record.TYPE.DNSKEY

    • getKeyTag

      public int getKeyTag()
      Retrieve the key tag identifying this DNSKEY. The key tag is used within the DS and RRSIG record to distinguish multiple keys for the same name. This implementation is based on the reference implementation shown in RFC 4034 Appendix B.
      Returns:
      this DNSKEY's key tag

    • serialize

      public void serialize(DataOutputStream dos) throws IOException
      Write the flags, protocol, algorithm number and key to the stream.
      Specified by:
      serialize in class Data
      Parameters:
      dos - the stream to write the wire format to
      Throws:
      IOException - if the stream rejects the write

    • toString

      public String toString()
      Diagnostic form of the record.
      Overrides:
      toString in class Object
      Returns:
      the flags, protocol, algorithm and base64 key, separated by spaces

    • getKeyLength

      public int getKeyLength()
      Length of the public key material.
      Returns:
      the number of bytes in the public key

    • getKey

      public byte[] getKey()
      Copy of the public key material.
      Returns:
      a copy of the key bytes, so callers cannot alter this record

    • getKeyAsDataInputStream

      public DataInputStream getKeyAsDataInputStream()
      Wrap the public key material in a stream.
      Returns:
      a stream reading over the key bytes

    • getKeyBase64

      public String getKeyBase64()
      Base64 encoding of the public key material, cached after the first call.
      Returns:
      the key encoded as base64

    • getKeyBigInteger

      public BigInteger getKeyBigInteger()
      The public key material as a big-endian integer, cached after the first call.
      Returns:
      the key as a BigInteger

    • keyEquals

      public boolean keyEquals(byte[] otherKey)
      Compare this record's key material against another key.
      Parameters:
      otherKey - the key bytes to compare against
      Returns:
      true if both keys are byte for byte identical

    • isSecureEntryPoint

      public boolean isSecureEntryPoint()
      Whether the secure entry point flag is set.
      Returns:
      true if this is a secure entry point key