为 DNSKEY 资源记录创建有效的 RSA/SHA256 密钥答案

【问题标题】：Creating valid RSA/SHA256 Key for DNSKEY Resource Record为 DNSKEY 资源记录创建有效的 RSA/SHA256 密钥
【发布时间】：2019-03-07 11:50:25
【问题描述】：

我正在 python 上编写 DNS 服务器，目前卡在 DNSSEC 的 DNSKEY 资源记录中。根据RFC5702 RSA/SHA256 的关键组件是：

Given a private key with the following values (in Base64):
Private-key-format: v1.2
Algorithm:       8 (RSASHA256)
Modulus:         wVwaxrHF2CK64aYKRUibLiH30KpPuPBjel7E8ZydQW1HYWHfoGm
                 idzC2RnhwCC293hCzw+TFR2nqn8OVSY5t2Q==
PublicExponent:  AQAB
PrivateExponent: UR44xX6zB3eaeyvTRzmskHADrPCmPWnr8dxsNwiDGHzrMKLN+i/
                 HAam+97HxIKVWNDH2ba9Mf1SA8xu9dcHZAQ==
Prime1:          4c8IvFu1AVXGWeFLLFh5vs7fbdzdC6U82fduE6KkSWk=
Prime2:          2zZpBE8ZXVnL74QjG4zINlDfH+EOEtjJJ3RtaYDugvE=
Exponent1:       G2xAPFfK0KGxGANDVNxd1K1c9wOmmJ51mGbzKFFNMFk=
Exponent2:       GYxP1Pa7CAwtHm8SAGX594qZVofOMhgd6YFCNyeVpKE=
Coefficient:     icQdNRjlZGPmuJm2TIadubcO8X7V4y07aVhX464tx8Q=

The DNSKEY record for this key would be:

example.net.     3600  IN  DNSKEY  (256 3 8 AwEAAcFcGsaxxdgiuuGmCkVI
                 my4h99CqT7jwY3pexPGcnUFtR2Fh36BponcwtkZ4cAgtvd4Qs8P
                 kxUdp6p/DlUmObdk= );{id = 9033 (zsk), size = 512b}

使用此示例，我试图通过解码 base64 示例值来获取原始键值：

newkey_n = int.from_bytes(base64.b64decode('wVwaxrHF2CK64aYKRUibLiH30KpPuPBjel7E8ZydQW1HYWHfoGmidzC2RnhwCC293hCzw+TFR2nqn8OVSY5t2Q=='), byteorder='big')
newkey_e = int.from_bytes(base64.b64decode('AQAB'), byteorder='big')
newkey_d = int.from_bytes(base64.b64decode('UR44xX6zB3eaeyvTRzmskHADrPCmPWnr8dxsNwiDGHzrMKLN+i/HAam+97HxIKVWNDH2ba9Mf1SA8xu9dcHZAQ=='), byteorder='big')
newkey_p = int.from_bytes(base64.b64decode('4c8IvFu1AVXGWeFLLFh5vs7fbdzdC6U82fduE6KkSWk='), byteorder='big')
newkey_q = int.from_bytes(base64.b64decode('2zZpBE8ZXVnL74QjG4zINlDfH+EOEtjJJ3RtaYDugvE='), byteorder='big')
newkey_u = int.from_bytes(base64.b64decode('icQdNRjlZGPmuJm2TIadubcO8X7V4y07aVhX464tx8Q='), byteorder='big')
newkey_exp1 = int.from_bytes(base64.b64decode('G2xAPFfK0KGxGANDVNxd1K1c9wOmmJ51mGbzKFFNMFk='), byteorder='big')
newkey_exp2 = int.from_bytes(base64.b64decode('GYxP1Pa7CAwtHm8SAGX594qZVofOMhgd6YFCNyeVpKE='), byteorder='big')

在此之后，我获得了构建 RSA 密钥所需的所有值：

from Crypto.PublicKey import RSA
key = RSA.construct((newkey_n, newkey_e, newkey_d, newkey_p, newkey_q, newkey_u))

但收到错误：

ValueError: RSA 因子与模数不匹配

我做错了什么？似乎 RSA/SHA 密钥生成几乎没有记录，或者我无法找到完整的文档。很高兴得到任何帮助。

【问题讨论】：

系数不对，应该是VXiG3Xe94k488uhnR5YTnMpAawUBDdWRoy+dSe40kuY=

标签： python-3.x encryption dns rsa dnssec

【解决方案1】：

从前 3 个参数构造 RSA：

key = RSA.construct((newkey_n, newkey_e, newkey_d))

【讨论】：

【解决方案2】：

自己找到了答案。如果有人遇到这个问题会发布它

DNSKEY 公钥字段组成：PublicExponent + PublicExponent + Modulus 的长度。所以：

import base64
from bitstring import BitArray
import math
modulus = int.from_bytes(base64.b64decode('wVwaxrHF2CK64aYKRUibLiH30KpPuPBjel7E8ZydQW1HYWHfoGmidzC2RnhwCC293hCzw+TFR2nqn8OVSY5t2Q=='), byteorder='big')
pe = int.from_bytes(base64.b64decode('AQAB'), byteorder='big')
len_pe = format(math.ceil(len(format(pe, 'b')) / 8), 'b').zfill(8)
pe = format(pe, 'b').zfill(8 * math.ceil(len(format(pe, 'b')) / 8))
modulus = format(modulus, 'b').zfill(8 * math.ceil(len(format(modulus, 'b')) / 8))
base64.b64encode(BitArray(bin=len_pe + pe + modulus).bytes)
print(base64.b64encode(BitArray(bin=len_pe + pe + modulus).bytes))
>> b'AwEAAcFcGsaxxdgiuuGmCkVImy4h99CqT7jwY3pexPGcnUFtR2Fh36BponcwtkZ4cAgtvd4Qs8PkxUdp6p/DlUmObdk='

结果与示例显示的结果相符

【讨论】：