(original) (raw)

Internet Assigned Numbers Authority Domain Name System Security (DNSSEC) Algorithm Numbers Created 2003-11-03 Last Updated 2024-04-16 Available Formats [IMG] XML [IMG] HTML [IMG] Plain text Registries included below • DNS Security Algorithm Numbers • DNS KEY Record Diffie-Hellman Prime Lengths • DNS KEY Record Diffie-Hellman Well-Known Prime/Generator Pairs DNS Security Algorithm Numbers Registration Procedure(s) RFC Required Reference [RFC4034][RFC3755][RFC6014][RFC6944] Note The KEY, SIG, DNSKEY, RRSIG, DS, and CERT RRs use an 8-bit number used to identify the security algorithm being used. All algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. Only algorithms usable for zone signing may appear in DNSKEY, RRSIG, and DS RRs. Only those usable for SIG(0) and TSIG may appear in SIG and KEY RRs. * There has been no determination of standardization of the use of this algorithm with Transaction Security. Available Formats [IMG] CSV Number Description Mnemonic Zone Trans. Reference Signing Sec. 0 Delete DS DELETE N N [RFC4034][proposed standard][RFC4398][proposed standard][RFC8078][proposed standard] 1 RSA/MD5 (DEPRECATED, see 5) RSAMD5 N Y [RFC3110][proposed standard][RFC4034][proposed standard] 2 Diffie-Hellman DH N Y [RFC2539][proposed standard] [RFC3755][proposed standard][RFC2536][proposed standard][Federal Information Processing Standards Publication (FIPS PUB) 186, Digital 3 DSA/SHA1 DSA Y Y Signature Standard, 18 May 1994.][Federal Information Processing Standards Publication (FIPS PUB) 180-1, Secure Hash Standard, 17 April 1995. (Supersedes FIPS PUB 180 dated 11 May 1993.)] 4 Reserved [RFC6725][proposed standard] 5 RSA/SHA-1 RSASHA1 Y Y [RFC3110][proposed standard][RFC4034][proposed standard] 6 DSA-NSEC3-SHA1 DSA-NSEC3-SHA1 Y Y [RFC5155][proposed standard] 7 RSASHA1-NSEC3-SHA1 RSASHA1-NSEC3-SHA1 Y Y [RFC5155][proposed standard] 8 RSA/SHA-256 RSASHA256 Y * [RFC5702][proposed standard] 9 Reserved [RFC6725][proposed standard] 10 RSA/SHA-512 RSASHA512 Y * [RFC5702][proposed standard] 11 Reserved [RFC6725][proposed standard] 12 GOST R 34.10-2001 ECC-GOST Y * [RFC5933][proposed standard][Change the status of GOST Signature (DEPRECATED) Algorithms in DNSSEC in the IETF stream to Historic] 13 ECDSA Curve P-256 with ECDSAP256SHA256 Y * [RFC6605][proposed standard] SHA-256 14 ECDSA Curve P-384 with ECDSAP384SHA384 Y * [RFC6605][proposed standard] SHA-384 15 Ed25519 ED25519 Y * [RFC8080][proposed standard] 16 Ed448 ED448 Y * [RFC8080][proposed standard] 17 SM2 signing algorithm with SM2SM3 Y * [RFC-cuiling-dnsop-sm2-alg-15][informational] SM3 hashing algorithm 18-22 Unassigned 23 GOST R 34.10-2012 ECC-GOST12 Y * [RFC9558][informational] 24-122 Unassigned 123-251 Reserved [RFC4034][proposed standard][RFC6014][proposed standard] 252 Reserved for Indirect Keys INDIRECT N N [RFC4034][proposed standard] 253 private algorithm PRIVATEDNS Y Y [RFC4034][proposed standard] 254 private algorithm OID PRIVATEOID Y Y [RFC4034][proposed standard] 255 Reserved [RFC4034][proposed standard] DNS KEY Record Diffie-Hellman Prime Lengths Registration Procedure(s) IETF Review Reference [RFC2539] Available Formats [IMG] CSV Value Description Reference 0 Unassigned 1 index into well-known table [RFC2539] 2 index into well-known table [RFC2539] 3-15 Unassigned DNS KEY Record Diffie-Hellman Well-Known Prime/Generator Pairs Reference [RFC2539] Available Formats [IMG] CSV Range Registration Procedures 0x0000-0x07ff Standards Action 0x0800-0xbfff RFC Required Value Description Reference 0x0000 Unassigned 0x0001 Well-Known Group 1: A 768 bit prime [RFC2539] 0x0002 Well-Known Group 2: A 1024 bit prime [RFC2539] 0x0003-0xbfff Unassigned 0xc000-0xffff Private Use [RFC2539] Licensing Terms