TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

Valid RSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ?

Error message

Valid RSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key size range is between 1024-4096 bits.

What it means

Thrown by DnssecPrivateKey.Create (the keySize overload) when the requested RSA key size is below 1024 or above 4096 bits, for any RSA-family DNSSEC algorithm (RSAMD5, RSASHA1, RSASHA1-NSEC3-SHA1, RSASHA256, RSASHA512). Key sizes outside this range are either cryptographically weak or not interoperable per DNSSEC norms. The message identifies whether the key is a KSK or ZSK.

Source

Thrown at DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs:189

            ReadPrivateKeyFrom(bR);
        }

        #endregion

        #region static

        public static DnssecPrivateKey Create(DnssecAlgorithm algorithm, DnssecPrivateKeyType keyType, int keySize = -1)
        {
            switch (algorithm)
            {
                case DnssecAlgorithm.RSAMD5:
                case DnssecAlgorithm.RSASHA1:
                case DnssecAlgorithm.RSASHA1_NSEC3_SHA1:
                case DnssecAlgorithm.RSASHA256:
                case DnssecAlgorithm.RSASHA512:
                    if ((keySize < 1024) || (keySize > 4096))
                        throw new ArgumentOutOfRangeException(nameof(keySize), $"Valid RSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key size range is between 1024-4096 bits.");

                    using (RSA rsa = RSA.Create(keySize))
                    {
                        return new DnssecRsaPrivateKey(algorithm, keyType, keySize, rsa.ExportParameters(true));
                    }

                case DnssecAlgorithm.ECDSAP256SHA256:
                    using (ECDsa ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP256))
                    {
                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));
                    }

                case DnssecAlgorithm.ECDSAP384SHA384:
                    using (ECDsa ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP384))
                    {
                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));
                    }

View on GitHub (pinned to d0484b6c1e)

Solutions

Pass an explicit keySize of 2048 (ZSK) or 4096 (KSK) for modern RSA DNSSEC.
Never rely on the default -1 for RSA — always specify a size in 1024–4096.
For ECDSA/EdDSA algorithms, omit keySize since the curve fixes the size.

Example fix

// before
var key = DnssecPrivateKey.Create(DnssecAlgorithm.RSASHA256, DnssecPrivateKeyType.KeySigningKey); // keySize defaults to -1 → throws

// after
var key = DnssecPrivateKey.Create(DnssecAlgorithm.RSASHA256, DnssecPrivateKeyType.KeySigningKey, 4096);

Defensive patterns

Strategy: validation

Validate before calling

static bool IsValidRsaKeySize(int size) => size >= 1024 && size <= 4096;

if (IsRsaAlgorithm(algo))
{
    if (!IsValidRsaKeySize(keySize))
        throw new InvalidOperationException("RSA keySize must be 1024–4096.");
}
var key = DnssecPrivateKey.Create(algo, keyType, keySize);

Type guard

static bool IsRsaAlgorithm(DnssecAlgorithm a) =>
    a is DnssecAlgorithm.RSAMD5 or DnssecAlgorithm.RSASHA1
       or DnssecAlgorithm.RSASHA1_NSEC3_SHA1
       or DnssecAlgorithm.RSASHA256 or DnssecAlgorithm.RSASHA512;

Try / catch

try { return DnssecPrivateKey.Create(algo, keyType, keySize); }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(keySize))
{
    // fall back to a safe default size for RSA
    return DnssecPrivateKey.Create(algo, keyType, algo is DnssecAlgorithm.RSASHA256 ? 2048 : keySize);
}

Prevention

Always pass an explicit keySize for RSA algorithms (never rely on the -1 default).
Use 2048 for ZSK and 4096 for KSK as a convention.
Validate keySize in your key-provisioning code before calling Create.

When it happens

Trigger: Calling DnssecPrivateKey.Create(algorithm, keyType, keySize) with an RSA algorithm and keySize not in [1024, 4096]. Passing the default -1 also falls below 1024 and throws.

Common situations: Forgetting to pass keySize (uses default -1 → invalid); passing 512/768 from old examples; passing an enormous size expecting stronger security.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/49600221d698f9aa. Report an issue: GitHub.