Integrating BIND 8.2

[Mark Kettenis]

   Date: Thu, 1 Apr 1999 08:55:50 +1000
   From: Geoff Keating <geoffk@ozemail.com.au>

   Happily, RFC 2535 obsoletes RFC 2065.  Now, it is the DSA algorithm
   that is mandatory.  So our problem has gone away; we can just avoid
   implementing RSA until the patent expires (whenever that is):

   3.2 The KEY Algorithm Number Specification
   ...
      Algorithm specific formats and procedures are given in separate
      documents.  The mandatory to implement for interoperability algorithm
      is number 3, DSA.  It is recommended that the RSA/MD5 algorithm,
      number 1, also be implemented.  Algorithm 2 is used to indicate
      Diffie-Hellman keys and algorithm 4 is reserved for elliptic curve.

Unfortunately we cannot use the DSA code included in bind 8.2, since
it is not freely distributable.  However, there are alternatives.
gnupg contains a GPL'ed implementation of DSA that may be adapted for
our use.  It probably must be converted to LGPL for this to be
possible, but the code is assigned to the FSF, so I guess this is not
impossible.  Another alternative is SSLeay (or OpenSSL) which includes
an extensive crypto library available under a BSD-style license
(unfortunately with the advertisement clause).  This crypto library
includes an RSA implementation too, but that is of no use for the poor
folks in the US.

The problem is that even DSA is still export restricted.  The FSF
might try to get an export license (which may be easier for DSA than
for DES since I read that DSA cannot be used for encryption).
Otherwise we'll have to distribute the DSA code as a seperately
maintained add-on.  I think it would be a good idea to turn the fixed
DST API <-> crypto API interface in BIND into a more modular system as
Zack suggested.

Anyway, I am willing to write and maintain a DSA module, so if the
plans to integrate BIND 8.2 get a little more concrete, feel free to
ask me.  I believe it is not a very large task if we use the GNU MP
Library and rip some parts out of gnupg.

Mark