On ti, 22 maalis 2022, lejeczek via FreeIPA-users wrote:
On 22/03/2022 12:22, Alexander Bokovoy wrote:
>On ti, 22 maalis 2022, lejeczek via FreeIPA-users wrote:
>>Hi guys.
>>
>>With latest IPA on CentOS 9, ver 4.9.8 & bind-9.16.23-1.el9.x86_64
>>- what would be a correct (temporary) workaround for those records
>>around the world which are signed with "oldish" crypts?
>
>Perhaps, try to use 'update-crypto-policies --set LEGACY'?
>
>
I thought slickest/safest - which I ended up doing - would be exclude
validation for given domain(s). (trying to make it survive rpm
updates)
Seems to work but I was not sure was it best best way.
thanks, L.
p.s. is the world ready for such hardened IPA/dns? I mean.. if
paypal.com cannot keep up..
SHAmbles attack is two years old, its application to DNSSEC is described
here:
https://www.dns.cam.ac.uk/news/2020-01-09-sha-mbles.html
In Fedora/RHEL/CentOS Stream we are using RSASHA256 (algorithm 8)
<Keys>
<!-- Parameters for both KSK and ZSK -->
<TTL>PT3600S</TTL>
<RetireSafety>PT3600S</RetireSafety>
<PublishSafety>PT3600S</PublishSafety>
<!-- <ShareKeys/> -->
<Purge>P14D</Purge>
<!-- Parameters for KSK only -->
<KSK>
<Algorithm
length="2048">8</Algorithm>
<Lifetime>P1Y</Lifetime>
<Repository>SoftHSM</Repository>
</KSK>
<!-- Parameters for ZSK only -->
<ZSK>
<Algorithm
length="2048">8</Algorithm>
<Lifetime>P90D</Lifetime>
<Repository>SoftHSM</Repository>
<!-- <ManualRollover/> -->
</ZSK>
</Keys>
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland