{"record":{"id":"f8242b9140bd49b9","repo":"TechnitiumSoftware/DnsServer","slug":"dnssec-algorithm-is-not-supported-algorithm","errorCode":null,"errorMessage":"DNSSEC algorithm is not supported: {algorithm}","messagePattern":"DNSSEC algorithm is not supported: (.+?)","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs","lineNumber":215,"sourceCode":"                    using (ECDsa ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP256))\n                    {\n                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));\n                    }\n\n                case DnssecAlgorithm.ECDSAP384SHA384:\n                    using (ECDsa ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP384))\n                    {\n                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));\n                    }\n\n                case DnssecAlgorithm.ED25519:\n                    return new DnssecEddsaPrivateKey(keyType, new Ed25519PrivateKeyParameters(RandomNumberGenerator.GetBytes(32)));\n\n                case DnssecAlgorithm.ED448:\n                    return new DnssecEddsaPrivateKey(keyType, new Ed448PrivateKeyParameters(RandomNumberGenerator.GetBytes(57)));\n\n                default:\n                    throw new NotSupportedException(\"DNSSEC algorithm is not supported: \" + algorithm.ToString());\n            }\n        }\n\n        public static DnssecPrivateKey Create(DnssecAlgorithm algorithm, DnssecPrivateKeyType keyType, string pemPrivateKey)\n        {\n            switch (algorithm)\n            {\n                case DnssecAlgorithm.RSAMD5:\n                case DnssecAlgorithm.RSASHA1:\n                case DnssecAlgorithm.RSASHA1_NSEC3_SHA1:\n                case DnssecAlgorithm.RSASHA256:\n                case DnssecAlgorithm.RSASHA512:\n                    using (RSA rsa = RSA.Create())\n                    {\n                        rsa.ImportFromPem(pemPrivateKey);\n\n                        if ((rsa.KeySize < 1024) || (rsa.KeySize > 4096))\n                            throw new ArgumentOutOfRangeException(nameof(pemPrivateKey), $\"Valid RSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key size range is between 1024-4096 bits.\");","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs#L197-L233","documentation":"Thrown by the default branch of DnssecPrivateKey.Create (keySize overload) when the supplied DnssecAlgorithm is not one of the supported set: RSAMD5, RSASHA1, RSASHA1-NSEC3-SHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, ED448. Algorithms like DSA, DSA-NSEC3-SHA1, ECC-GOST, or any undefined enum value reach this branch. This is a NotSupportedException because the algorithm is known to DNSSEC but not implemented.","triggerScenarios":"Calling DnssecPrivateKey.Create with DnssecAlgorithm.DSA, DnssecAlgorithm.DSA_NSEC3_SHA1, DnssecAlgorithm.ECC_GOST, or a cast integer that does not map to a supported algorithm.","commonSituations":"Parsing an algorithm name/value from user input or a DS record without filtering; importing keys intended for an algorithm this build doesn't implement; casting an out-of-range byte to the enum.","solutions":["Use one of the supported algorithms (RSASHA256/RSASHA512, ECDSAP256SHA256/ECDSAP384SHA384, or ED25519/ED448).","Validate the algorithm against the supported set before calling Create.","If you need DSA/GOST, switch to an algorithm this library implements."],"exampleFix":"// before\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.DSA, DnssecPrivateKeyType.ZoneSigningKey, 1024);\n\n// after\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP256SHA256, DnssecPrivateKeyType.ZoneSigningKey);","handlingStrategy":"type-guard","validationCode":"static readonly HashSet<DnssecAlgorithm> Supported = new()\n{\n    DnssecAlgorithm.RSAMD5, DnssecAlgorithm.RSASHA1, DnssecAlgorithm.RSASHA1_NSEC3_SHA1,\n    DnssecAlgorithm.RSASHA256, DnssecAlgorithm.RSASHA512,\n    DnssecAlgorithm.ECDSAP256SHA256, DnssecAlgorithm.ECDSAP384SHA384,\n    DnssecAlgorithm.ED25519, DnssecAlgorithm.ED448,\n};\n\nif (!Supported.Contains(algo))\n    throw new ArgumentException($\"Algorithm {algo} is not supported by this build.\");\nvar key = DnssecPrivateKey.Create(algo, keyType, keySize);","typeGuard":"static bool IsSupportedDnssecAlgorithm(DnssecAlgorithm a) =>\n    a is DnssecAlgorithm.RSAMD5 or DnssecAlgorithm.RSASHA1\n       or DnssecAlgorithm.RSASHA1_NSEC3_SHA1 or DnssecAlgorithm.RSASHA256\n       or DnssecAlgorithm.RSASHA512 or DnssecAlgorithm.ECDSAP256SHA256\n       or DnssecAlgorithm.ECDSAP384SHA384 or DnssecAlgorithm.ED25519\n       or DnssecAlgorithm.ED448;","tryCatchPattern":"try { return DnssecPrivateKey.Create(algo, keyType, keySize); }\ncatch (NotSupportedException) { /* unsupported algorithm */ throw new ArgumentException(\"Pick a supported DNSSEC algorithm.\"); }","preventionTips":["Whitelist supported algorithms at the config/input boundary.","Offer users only supported choices in any UI.","Map incoming DS-record algorithm numbers to the supported set."],"tags":["dns","dnssec","crypto","algorithm","not-supported"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}