Hacker News Reader

Comment by forkqueue | Hacker News Reader

Part of the reason small size keys like this are in common use is that bind (and possibly other name daemons) doesn't allow records larger than 255 characters. DKIM requires one to put the public key in DNS.

Earlier this week I set up DKIM, and initially tried and failed to use a 2048-bit key, because of this issue.

View on HN

  $ openssl genrsa -out private.key 1024
  $ openssl rsa -in private.key -out public.key -pubout -outform PEM
  writing RSA key
  $ grep -v '^--' public.key | wc -c
  220

So, 1024 bit key should be ok.

It's not specific to bind:

RFC 1035 says the following:

  2.3.4. Size limits
  
  Various objects and parameters in the DNS have size
  limits.  They are listed below.  Some could be easily
  changed, others are more fundamental.
  
  labels          63 octets or less
  
  names           255 octets or less
  
  TTL             positive values of a signed 32 bit number.
  
  UDP messages    512 octets or less

Although if the response to a query doesn't fit, the TC bit is supposed to be set and clients should retry over TCP. This is rare enough in practice, though, that not all implementations bother.

Reply on news.ycombinator.com