Editing DNSSEC (section)

== Key Data Interface ==

Key data may be provided OPTIONALLY when using the DS Data Interface, using these parameters:

<pre>secDNS-key# = <flags> <protocol> <alg> <pubKey>  (AddDomain/ModifyDomain)</pre>
<pre>addsecDNS-key# = <flags> <protocol> <alg> <pubKey>  (ModifyDomain)</pre>
<pre>delsecDNS-key# = <flags> <protocol> <alg> <pubKey>  (ModifyDomain)</pre>

The order of these whitespace-separated parameters matches the DNS DNSKEY record type.


<pre>secDNS-key flags = <INT></pre>

A parameter that contains a flags field value as described in Section 2.1.1 of RFC 4034.


<pre>secDNS-key protocol = <INT></pre>

A parameter that contains a protocol field value as described in Section 2.1.2 of RFC 4034.

The Protocol Field MUST have value 3, no other values are accepted. 


<pre>secDNS-key alg = <INT></pre>

A parameter that contains an algorithm number field value as described in Section 2.1.3 of RFC 4034.

RSA/MD5 (deprecated) - Algorithm Number 1<br/>
Diffie-Hellman (deprecated) - Algorithm Number 2<br/>
DSA/SHA-1 (deprecated) - Algorithm Number 3<br/>
RSA/SHA-1 (deprecated) - Algorithm Number 5<br/>
DSA-NSEC3-SHA1 (deprecated) - Algorithm Number 6<br/>
RSA/SHA-1 (deprecated) - Algorithm Number 7<br/>
RSA/SHA-256 - Algorithm Number 8<br/>
DSA/SHA-1 (deprecated) - Algorithm Number 6<br/>
ECDSA Curve P-256 with SHA-256 - Algorithm Number 13<br/>
ECDSA Curve P-384 with SHA-384 - Algorithm Number 14<br/>

A number of these algorithms are now deprecated due to weaknesses in SHA-1. The remaining algorithms are 8, 13, and 14.<br/>
These are just a few examples of algorithm types used in DNSSEC. It's important to note that algorithm support may vary depending on the DNS software and configuration in use by the registry.


<pre>secdns-key pubKey = <TEXT></pre>

A parameter that contains an encoded public key field value as described in Section 2.1.4 of RFC 4034.
The parameter is represented as a base64Binary [W3C.REC-xmlschema-2-20010502] with a minimum length of 1.