Homepage

DNS managed zone DNSSEC zone-signing keys should not use RSASHA1 Affecting Cloud DNS service in Google

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Network/ Security

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-GoogleCSA-CCMISO-27001NIST-800-53PCI-DSSSOC-2
  • Snyk IDSNYK-CC-00404
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

DNS managed zone DNSSEC zone-signing keys should not use RSASHA1. Domain Name System Security Extensions (DNSSEC) algorithm numbers may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The zone-signing key algorithm should be strong, and RSASHA1 is no longer considered secure. Use it only for compatibility reasons.

How to fix?

Do not Set default_key_specs.algorithm = "rsasha1". DNS managed zone DNSSEC zone-signing keys should not use RSASHA1.

Example configuration:

resource "google_dns_managed_zone" "allowed1" {
  name     = "test404-a"
  dns_name = "dns.google."
  project  = "test-project"

  dnssec_config {
    state = "on"

    default_key_specs {
      algorithm  = "rsasha256"
      key_length = 2048
      key_type   = "keySigning"
    }

    default_key_specs {
      algorithm  = "rsasha256"
      key_length = 1024
      key_type   = "zoneSigning"
    }
  }
}