Use of SHA-256 in DNSSEC Delegation Signer (DS) Resource Records (RRs)
Extracted elements (10)
Zone operators should consider deploying both SHA-1 and SHA-256 DS records for every DNSKEY during the transition period, because zone administrators cannot control how quickly validators add SHA-256 support, and dropping SHA-1 prematurely could break authentication paths.
If a validator does not support SHA-256 and no other supported digest type exists in the DS RRset, the validator has no supported authentication path from parent to child and should treat this as it would an authenticated NSEC RRset proving no DS RRset exists, per RFC 4035 Section 5.2.
Implementations MUST support the use of the SHA-256 algorithm in DS RRs.
The results of the SHA-256 digest algorithm MUST NOT be truncated; the entire 32-byte digest result must be published in the DS record.
Validator implementations SHOULD ignore DS RRs containing SHA-1 digests if DS RRs with SHA-256 digests are present in the DS RRset, to prefer the stronger digest type.
Digest type code 2 is assigned to SHA-256 for use within DNSSEC DS records. The digest is computed as SHA_256(DNSKEY owner name | DNSKEY RDATA), where DNSKEY RDATA consists of Flags, Protocol, Algorithm, and Public Key fields.
IANA assigned digest type 2 to SHA-256 for the DS record Digest Type registry. The registry at the time of publication shows: 0=Reserved, 1=SHA-1 (MANDATORY), 2=SHA-256 (MANDATORY), 3-255=Unassigned.
A digest type downgrade attack is possible when multiple DS records for the same DNSKEY use different digest types and a validator accepts a weaker digest even if a stronger one is present but fails to match. Validators SHOULD ignore weaker digests (e.g., SHA-1) when stronger ones (SHA-256) are present, as specified in Section 3.
SHA-256 is considered more resilient than SHA-1 and is the better choice for DS records; users of DNSSEC are encouraged to deploy SHA-256 as soon as software implementations allow, given eroding confidence in SHA-1 due to announced attacks.
The DS record wire format for SHA-256 (DigestType=2) contains a 16-bit Key Tag, an 8-bit Algorithm, an 8-bit DigestType field set to 2, followed by a 32-byte (256-bit) SHA-256 Digest field.