EdDSA Value for IPSECKEY
Extracted elements (6)
The EdDSA public key encoding in the IPSECKEY RR reuses the format defined for DNSSEC in RFC 8080 Section 3, ensuring consistency between the two uses of EdDSA in the DNS.
When using an EdDSA public key in the IPSECKEY RR, the value 4 MUST be used as the algorithm type field value, and the public key MUST be formatted as specified in RFC 8080 Section 3.
EdDSA public keys are supported in the IPSECKEY resource record using algorithm value 4. The public key is formatted as specified in RFC 8080 Section 3 (Edwards-Curve Digital Security Algorithm for DNSSEC).
IANA updated the 'Algorithm Type Field' registry within 'IPSECKEY Resource Record Parameters' by adding a 'Format Description' field and updating existing entries to explicitly state they are for 'Public' keys. Value 4 was added for EdDSA public keys, referencing RFC 8080 Section 3.
The IPSECKEY Algorithm Type Field registry now contains four values: 0 (No Public Key), 1 (DSA Public Key, RFC 2536 §2), 2 (RSA Public Key, RFC 3110 §2), 3 (ECDSA Public Key, RFC 6605 §4), and 4 (EdDSA Public Key, RFC 8080 §3).
The security considerations of RFC 4025 apply to this document. No new security considerations are introduced by adding EdDSA as an algorithm type for the IPSECKEY RR.