{"record":{"id":"49600221d698f9aa","repo":"TechnitiumSoftware/DnsServer","slug":"valid-rsa-keytype-dnssecprivatekeytype-keysi","errorCode":null,"errorMessage":"Valid RSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key size range is between 1024-4096 bits.","messagePattern":"Valid RSA \\((.+?)\\) private key size range is between 1024-4096 bits\\.","errorType":"exception","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs","lineNumber":189,"sourceCode":"\n            ReadPrivateKeyFrom(bR);\n        }\n\n        #endregion\n\n        #region static\n\n        public static DnssecPrivateKey Create(DnssecAlgorithm algorithm, DnssecPrivateKeyType keyType, int keySize = -1)\n        {\n            switch (algorithm)\n            {\n                case DnssecAlgorithm.RSAMD5:\n                case DnssecAlgorithm.RSASHA1:\n                case DnssecAlgorithm.RSASHA1_NSEC3_SHA1:\n                case DnssecAlgorithm.RSASHA256:\n                case DnssecAlgorithm.RSASHA512:\n                    if ((keySize < 1024) || (keySize > 4096))\n                        throw new ArgumentOutOfRangeException(nameof(keySize), $\"Valid RSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key size range is between 1024-4096 bits.\");\n\n                    using (RSA rsa = RSA.Create(keySize))\n                    {\n                        return new DnssecRsaPrivateKey(algorithm, keyType, keySize, rsa.ExportParameters(true));\n                    }\n\n                case DnssecAlgorithm.ECDSAP256SHA256:\n                    using (ECDsa ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP256))\n                    {\n                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));\n                    }\n\n                case DnssecAlgorithm.ECDSAP384SHA384:\n                    using (ECDsa ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP384))\n                    {\n                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));\n                    }\n","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs#L171-L207","documentation":"Thrown by DnssecPrivateKey.Create (the keySize overload) when the requested RSA key size is below 1024 or above 4096 bits, for any RSA-family DNSSEC algorithm (RSAMD5, RSASHA1, RSASHA1-NSEC3-SHA1, RSASHA256, RSASHA512). Key sizes outside this range are either cryptographically weak or not interoperable per DNSSEC norms. The message identifies whether the key is a KSK or ZSK.","triggerScenarios":"Calling DnssecPrivateKey.Create(algorithm, keyType, keySize) with an RSA algorithm and keySize not in [1024, 4096]. Passing the default -1 also falls below 1024 and throws.","commonSituations":"Forgetting to pass keySize (uses default -1 → invalid); passing 512/768 from old examples; passing an enormous size expecting stronger security.","solutions":["Pass an explicit keySize of 2048 (ZSK) or 4096 (KSK) for modern RSA DNSSEC.","Never rely on the default -1 for RSA — always specify a size in 1024–4096.","For ECDSA/EdDSA algorithms, omit keySize since the curve fixes the size."],"exampleFix":"// before\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.RSASHA256, DnssecPrivateKeyType.KeySigningKey); // keySize defaults to -1 → throws\n\n// after\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.RSASHA256, DnssecPrivateKeyType.KeySigningKey, 4096);","handlingStrategy":"validation","validationCode":"static bool IsValidRsaKeySize(int size) => size >= 1024 && size <= 4096;\n\nif (IsRsaAlgorithm(algo))\n{\n    if (!IsValidRsaKeySize(keySize))\n        throw new InvalidOperationException(\"RSA keySize must be 1024–4096.\");\n}\nvar key = DnssecPrivateKey.Create(algo, keyType, keySize);","typeGuard":"static bool IsRsaAlgorithm(DnssecAlgorithm a) =>\n    a is DnssecAlgorithm.RSAMD5 or DnssecAlgorithm.RSASHA1\n       or DnssecAlgorithm.RSASHA1_NSEC3_SHA1\n       or DnssecAlgorithm.RSASHA256 or DnssecAlgorithm.RSASHA512;","tryCatchPattern":"try { return DnssecPrivateKey.Create(algo, keyType, keySize); }\ncatch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(keySize))\n{\n    // fall back to a safe default size for RSA\n    return DnssecPrivateKey.Create(algo, keyType, algo is DnssecAlgorithm.RSASHA256 ? 2048 : keySize);\n}","preventionTips":["Always pass an explicit keySize for RSA algorithms (never rely on the -1 default).","Use 2048 for ZSK and 4096 for KSK as a convention.","Validate keySize in your key-provisioning code before calling Create."],"tags":["dns","dnssec","crypto","rsa","validation","key-size"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}