OpenDKIM icon indicating copy to clipboard operation
OpenDKIM copied to clipboard

Fix ed25519 key comparison in dkim_test_key

Open jcastle-gh opened this issue 10 months ago • 0 comments

dkim_test_key() compares a public DKIM key retrieved from DNS with the public key generated by i2d_PUBKEY_BIO() from a known private key. The output of i2d_PUBKEY_BIO is in SubjectPublicKey ASN encoded format.

That works for RSA where the key in DNS is also in that format but for ed25519 the key in DNS is the DER encoded key by itself. The difference boils down to a 12-byte constant ASN prefix in the i2d_PUBKEY_BIO() output that is not in the DNS version.

Fix it by verifying that the i2d_PUBKEY_BIO() output for ed25519 keys has the expected 12-byte prefix and then comparing what's left to the key from DNS.

jcastle-gh avatar Mar 15 '25 07:03 jcastle-gh