Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

From this ISC BIND article example:

https://kb.isc.org/article/AA-00626/0/Inline-Signing-in-ISC-BIND-9.9.0-Examples.html

$ dnssec-keygen example.com
    Generating key pair........................+++++
    ...............++++++ 
    Kexample.com.+005+17262
$ dnssec-keygen -fk example.com
    Generating key pair.....................................+++++
    ........................................................+++ 
    Kexample.com.+005+44139

I tried them on Centos 5 (x64) and saw that dnssec-keygen works so slow.

If I add another option argument, it work immediately.

Example:

dnssec-keygen -r random.data example.com

It does not happen on the Windows OS.

After trying to debug, I see it stick around the

RSA_generate_key_ex(rsa, key->key_size, e, &cb))

in the

 lib\dns\opensslrsa_link.c

I have tried to sent mail to ISC but they don't reply anymore.

Do you have any ideas?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

It's probably be a lack of entropy, not uncommon especially on virtualised and/or mostly idle systems.

Without checking the code it might be that the random input needed for generating proper keys is retrieved from /dev/random which IIRC is unlike /dev/urandom in that it blocks when there's unsufficient entropy (i.e. randomness) available. You can check the number of bits available in /proc/sys/kernel/random/entropy_avail.

You can help increase the amount of entropy by generating interupts (hit the keyboard, play with the mouse, run find / , compile a new kernel etc.), get a hardware random number generator, or, if your security requirements aren't very high install rngd-tools and use /dev/urandom as a work-around to increase the amount of pseudo entropy: rngd -r /dev/urandom -o /dev/random -b.

share|improve this answer
    
Thank you very much. Actually, I have never needed to try "dnssec-keygen example.com". Thanks for helping me to understand the issue clearly:) –  Tuan Jan 3 at 9:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.