RSASHA1 Should Not Be Used For Key Signing

More Info:

Ensure that RSASHA1 is not used for the key-signing key in Cloud DNS DNSSEC.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS GCP
• CIS GCP 2.0.0
• Cloudanix Best Practice

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the RSASHA1 should not be used for key signing issue on GCP, you can follow the below steps:

1. Open the Cloud Console and navigate to the Cloud DNS page.
2. Select the name of the managed zone for which you want to update the DNSSEC settings.
3. In the Security section, click on the Edit button.
4. In the Algorithms section, uncheck the RSASHA1 checkbox.
5. Click Save to update the DNSSEC settings.

By unchecking the RSASHA1 checkbox, you will ensure that the RSASHA1 algorithm is not used for key signing, which will remediate the issue.

Using CLI

To remediate the "RSASHA1 Should Not Be Used For Key Signing" misconfiguration in GCP using GCP CLI, you can follow the below steps:

1. Open the Cloud Shell in the GCP Console.

2. Run the following command to list all the DNS managed zones in your project:

   gcloud dns managed-zones list

3. Choose the managed zone for which you want to remediate the misconfiguration and note down the managed-zone-name.

4. Run the following command to get the DNSSEC configuration for the chosen managed zone:

   gcloud dns managed-zones describe <managed-zone-name>

5. If the state field in the output shows on, then DNSSEC is enabled for the zone and you need to disable it.

6. Run the following command to disable DNSSEC for the chosen managed zone:

   gcloud dns managed-zones update <managed-zone-name> --dnssec-state off

7. Verify that the state field in the output of the describe command shows off to confirm that DNSSEC has been disabled for the managed zone.

By following these steps, you can remediate the "RSASHA1 Should Not Be Used For Key Signing" misconfiguration in GCP using GCP CLI.

Using Python

To remediate the RSASHA1 should not be used for key signing issue in GCP using Python, you can follow the below steps:

1. Install the Google Cloud DNS Python library using the following command:

pip install google-cloud-dns

2. Create a DNS client object using the following code:

from google.cloud import dns

client = dns.Client()

3. Get the DNS zone using the following code:

zone_name = 'example.com.'
zone = client.zone(zone_name)

4. Get the DNS records using the following code:

records = zone.list_resource_record_sets()

5. Iterate over the records and check if any record uses the RSASHA1 algorithm for key signing. If found, update the record using the SHA256 algorithm using the following code:

for record in records:
    if record.signature_algorithm == 'RSASHA1':
        record.signature_algorithm = 'RSASHA256'
        zone.update_record(record)

6. Once all the records have been updated, commit the changes using the following code:

zone.commit()

By following these steps, you can remediate the RSASHA1 should not be used for key signing issue in GCP using Python.

Using Terraform

resource "google_dns_managed_zone" "DNS_ZONE_NAME" {
  name        = "DNS_ZONE_NAME"            # replace with your managed zone's name
  dns_name    = "EXAMPLE_DNS_NAME."        # replace with your DNS name, must end with a dot
  description = "DNS zone with secure DNSSEC configuration"

  dnssec_config {
    state = "on"

    # Key-signing key (KSK) – must NOT use RSASHA1
    default_key_specs {
      key_type  = "keySigning"
      algorithm = "rsasha256"              # change from "rsasha1" to "rsasha256"
      key_length = 2048                    # adjust if you have specific requirements
    }

    # Zone-signing key (ZSK) – example; keep or adjust as needed
    default_key_specs {
      key_type  = "zoneSigning"
      algorithm = "rsasha256"
      key_length = 1024
    }
  }
}

Changing the algorithm for key_type = "keySigning" from rsasha1 to a stronger option like rsasha256 will rotate the DNSSEC key-signing key; this does not recreate the managed zone but does trigger DNSSEC key changes and associated propagation.

For verification, terraform plan should show a single update in-place on google_dns_managed_zone.DNS_ZONE_NAME with a change to dnssec_config[0].default_key_specs[*].algorithm from "rsasha1" to "rsasha256" for the key-signing key.