Ed25519.no

This domain is protected with DNSSEC algorithm 15 (Ed25519). It is hosted at domainname.shop. They sign all their zones using DNSSEC by default.

Ed25519 was standardized for use with DNSSEC in February 2017 (RFC8080) and has been a RECOMMENDED algorithm since June 2019 (RFC8624). It has been supported in the .no zone since February 2020. The latest stable versions of OpenSSL (3.x) fully support Ed25519. All older versions (including 1.1.1, 1.1.0, 1.0.2 and 1.0.0) are now out of support and users of these older versions are encouraged to upgrade to 3.x as soon as possible. Ed25519 is also supported by the public resolvers of CloudFlare (1.1.1.1), Google (8.8.8.8) and Quad9 (9.9.9.9), and it is expected to become the future RECOMMENDED default DNSSEC algorithm.

Ed25519 is an Edwards-curve Digital Signature Algorithm (EdDSA). Like other ellipctic curve algorithms, its main advantage over RSA is that it offers the same level of security with much shorter key lengths, leading to shorter DNSKEY and RRSIG records. This in turn means that most DNS responses will fit in a single UDP packet (<512 bytes), and the potential for DNS amplification DDoS attacks is greatly reduced. EdDSA also has a number of advantages over ECDSA algorithms such as DNSSEC algorithm 13 (ECDSA P-256) and 14 (ECDSA P-384): it is faster, it is not dependent on a unique random number when generating signatures, it is more resilient to side-channel attacks, and it is easier to implement correctly.

Key length vs. security

AlgorithmDNSSEC algorithm numberSecurity level (bits)DNSKEY length (bytes)Sample DNSKEY (base64)
RSA-10245/7/8/1080132
AwEAAezl4fatziafieMI54HzXz9BF3GXjCKn0Z5x/gLLe2fVBvIbQcwRPaDf2QMxXaO8gCV1GofAn+DiRyUl9rB3K/8l7RRTHqh8PLtMCgKMOgnMoAb7+3X3v1CfDv/4JhFOo0BekT6gX2pV2/EfK2Fi7JJAfbyaI/CrxX9M0k78Rcoz
RSA-20485/7/8/10112260
AwEAAbsb7WU7gV6tnzHJhWul76MYRNpiaYLL7hHKzAR2XSyYD+nNRAgd+Ho9kNHacN4kMsZ/krE0/NtFowpiiufl+FnSeYgbCaWzoyAPEn4IkvDBPv/4uF6AfOCtzPi8zmWgY56KPXsALo8bFuxWMzxcwMxoW29N2Va297vFA4Qul5eYUoPsTOP4OnWYJTRh4qS7cDYausDfJZF2tpH7vufDgloTbs+HfjLqjf012ueiLCV/qGbaRffa4fNB8oTl4BTFvlUWUTtWw3zCRNrAXlK050vV9FvqCXUAcddxcJui0oH5++N2/MwY0GoyE1g2+gTeoJqZxeUSAErE3lyNby6eERs=
RSA-30725/7/8/10128388
AwEAAd2UmZElsfz+6SYrfNhjd9PNIdXAerDJp0uSsjJIavVZt4O26PosRq3qvu1LQ9WNjfS17wvOeALD+i96LDqLPRSIxR7vq636gvreYenhmGxEb4qiTglnQkAlbvMwkyPKqdD5zyBcR/Er90Sfy+1lKtsUIQydDJcsjp6jHf6e31hsLhmDspjnAQKPdL+BWItnNE/oGAJeJI2F2uulC1NYIMl8+/sV5ERMzuqpxnixSMASQhGQlpZO7pJaCKi//ov1zzWSaDkQa/OdIirOQl06fgrMuxUdVe+W1dc17roCLqVivmB7McvTeXVVEynsJeGoCFzeAVO0uCot3WTXOWKpNLOvsdpoun15Q+w5ZWei6+JT5P+iJ8UMcYJeh8QwXKk+wBurjZgEurkP9oRNXJfoi1UUIlDH6fCsaCE7k7Cb/NjMr6nmhZgIHpnFACuOEO6p36ws5BoV+AVACmyiPDpWI25tHjnSLhGXVpJyoQjOvQujivU8IDn7rumvk4nn7C5k3Q==
ECDSA P-2561312864
OzyAWTHir/UqW2Zj1OvzCwkIBJ4eFPIB4GEXp6CkNC3QnNDapAVlaZc2rPz+AgdJf9jUlxr0v1Yeu/wJJKiQTA==
ECDSA P-3841419296
mfdcZ1hUF8YW8qFqfJs498QeZ2eS30h2od0q7DVH/HLHTqwOfliC1qnem3zCt0XeNrgS/kTt8lp/eRzu+/Y+Zy7dKP+TupWq72QkWZSGNVtryCiyYRD5jrO1oH+wt1Ao
Ed255191512832
gUWHhcx2ABPH7JMWvf5OX0BFIC8NKrZ73v6lP8TBrJ4=
Ed4481622456
tpzCLdoTDnPXN091n2UfPvF9b0YcfIOZ2VkIpkPNcL70h7gznRXtEvBI+LZxxpxdGkaPTB/508UA

Resolver support

Here is a list of current DNSSEC algorithms that your resolver supports, courtesy of rootcanary.org.

 
5: RSA-SHA1
7: RSA-SHA1-NSEC3
8: RSA-SHA256
10: RSA-SHA512
13: ECDSA P-256
14: ECDSA P-384
15: Ed25519
16: Ed448
SHA-1
SHA-256
SHA-384

OK DNSSEC validation succeeded for this DS and signing algorithm combination
NO This DS and signing algorithm combination are not validated by your resolver(s)
KO This DS and signing algorithm lead to a SERVFAIL

Worldwide deployment

The DNSThough project by NLnet Labs measures worldwide DNSSEC algorithm support and publishes updated statistics at regular intervals.

Tools for DNSSEC validation

Here is a collection of tools to verify that DNSSEC has been correctly configured for a particular zone:

See also

Below are a few links for further reading: