From: Bert Hubert <bert.hubert@netherlabs.nl>
Date: Tue, 25 Jan 2011 07:51:55 +0000 (+0000)
Subject: 'multi-algorithm support' - for now we still only do RSA, but the whole signer stuff... 
X-Git-Tag: auth-3.0~342
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=699e6e377b575175d7143d3a006b10067182a791;p=thirdparty%2Fpdns.git

'multi-algorithm support' - for now we still only do RSA, but the whole signer stuff has been abstracted out, and we could in theory add KnapsackCRC32 code!
Or of course ECDSA or GOST ;-)


git-svn-id: svn://svn.powerdns.com/pdns/trunk/pdns@1905 d19b8d6e-7fed-0310-83ef-9ca221ded41b
---

diff --git a/pdns/dbdnsseckeeper.cc b/pdns/dbdnsseckeeper.cc
index a1c6d32b6d..f60b168ad6 100644
--- a/pdns/dbdnsseckeeper.cc
+++ b/pdns/dbdnsseckeeper.cc
@@ -80,11 +80,13 @@ void DNSSECKeeper::addKey(const std::string& name, bool keyOrZone, int algorithm
 {
   if(!bits)
     bits = keyOrZone ? 2048 : 1024;
-  DNSSECPrivateKey dpk;
-  dpk.d_key.create(bits); 
-  dpk.d_algorithm = algorithm;
-  dpk.d_flags = keyOrZone ? 257 : 256;
-  addKey(name, dpk, active);
+  DNSSECPrivateKey dspk;
+  shared_ptr<DNSPrivateKey> dpk(new RSADNSPrivateKey); // defaults to RSA for now, could be smart w/algorithm! XXX FIXME
+  dpk->create(bits);
+  dspk.setKey(dpk);
+  dspk.d_algorithm = algorithm;
+  dspk.d_flags = keyOrZone ? 257 : 256;
+  addKey(name, dspk, active);
 }
 
 void DNSSECKeeper::clearCaches(const std::string& name)
@@ -106,7 +108,7 @@ void DNSSECKeeper::addKey(const std::string& name, const DNSSECPrivateKey& dpk,
   DNSBackend::KeyData kd;
   kd.flags = dpk.d_flags; // the dpk doesn't get stored, only they key part
   kd.active = active;
-  kd.content = dpk.d_key.convertToISC(dpk.d_algorithm);
+  kd.content = dpk.getKey()->convertToISC(dpk.d_algorithm);
  // now store it
   d_db.addDomainKey(name, kd);
 }
@@ -127,7 +129,8 @@ DNSSECPrivateKey DNSSECKeeper::getKeyById(const std::string& zname, unsigned int
       continue;
     
     DNSSECPrivateKey dpk;
-    DNSKEYRecordContent dkrc = getRSAKeyFromISCString(&dpk.d_key.getContext(), kd.content);
+    DNSKEYRecordContent dkrc;
+    dpk.setKey(shared_ptr<DNSPrivateKey>(DNSPrivateKey::fromISCString(dkrc, kd.content)));
     dpk.d_flags = kd.flags;
     dpk.d_algorithm = dkrc.d_algorithm;
     
@@ -272,7 +275,8 @@ DNSSECKeeper::keyset_t DNSSECKeeper::getKeys(const std::string& zone, boost::tri
   {
     DNSSECPrivateKey dpk;
 
-    DNSKEYRecordContent dkrc=getRSAKeyFromISCString(&dpk.d_key.getContext(), kd.content);
+    DNSKEYRecordContent dkrc;
+    dpk.setKey(shared_ptr<DNSPrivateKey>(DNSPrivateKey::fromISCString(dkrc, kd.content)));
     dpk.d_flags = kd.flags;
     dpk.d_algorithm = dkrc.d_algorithm;
     if(dpk.d_algorithm == 5 && getNSEC3PARAM(zone))
diff --git a/pdns/dnssecinfra.cc b/pdns/dnssecinfra.cc
index 2d652e315c..7835d428c7 100644
--- a/pdns/dnssecinfra.cc
+++ b/pdns/dnssecinfra.cc
@@ -22,7 +22,7 @@ using namespace boost;
 using namespace std;
 using namespace boost::assign;
 
-void RSAContext::create(unsigned int bits)
+void RSADNSPrivateKey::create(unsigned int bits)
 {
   havege_state hs;
   havege_init( &hs );
@@ -33,7 +33,7 @@ void RSAContext::create(unsigned int bits)
     throw runtime_error("Key generation failed");
 }
 
-std::string RSAContext::getPubKeyHash()
+std::string RSADNSPrivateKey::getPubKeyHash() const
 {
   unsigned char hash[20];
   unsigned char N[mpi_size(&d_context.N)];
@@ -49,7 +49,22 @@ std::string RSAContext::getPubKeyHash()
   return string((char*)hash, sizeof(hash));
 }
 
-std::string RSAContext::convertToISC(unsigned int algorithm) const
+std::string RSADNSPrivateKey::sign(const std::string& hash) const
+{
+  unsigned char signature[mpi_size(&d_context.N)];
+  int ret=rsa_pkcs1_sign(const_cast<rsa_context*>(&d_context), RSA_PRIVATE, 
+    hash.size()==20 ? SIG_RSA_SHA1 : SIG_RSA_SHA256, 
+    hash.size(),
+    (const unsigned char*) hash.c_str(), signature);
+  
+  if(ret!=0) {
+    cerr<<"signing returned: "<<ret<<endl;
+    exit(1);
+  }
+  return string((char*) signature, sizeof(signature));
+}
+
+std::string RSADNSPrivateKey::convertToISC(unsigned int algorithm) const
 {
   string ret;
   typedef vector<pair<string, const mpi*> > outputs_t;
@@ -89,95 +104,81 @@ std::string RSAContext::convertToISC(unsigned int algorithm) const
 }
 
 
-DNSKEYRecordContent getRSAKeyFromISC(rsa_context* rsa, const char* fname)
+DNSPrivateKey* DNSPrivateKey::fromISCFile(DNSKEYRecordContent& drc, const char* fname)
 {
-  string sline;
-  string key,value;
-  map<string, mpi*> places;
-
+  string sline, isc, key, value;
   FILE *fp=fopen(fname, "r");
-  if(!fp)
-    unixDie("opening file '"+string(fname)+"'");
-
-  rsa_init(rsa, RSA_PKCS_V15, 0, NULL, NULL );
+  if(!fp) {
+    throw runtime_error("Unable to read file '"+string(fname)+"' for generating DNS Private Key");
+  }
+  int algorithm=0;
+  while(stringfgets(fp, sline)) {
+    tie(key,value)=splitField(sline, ':');
+    if(pdns_iequals(key,"algorithm"))
+      algorithm = atoi(value.c_str());
+    isc.append(sline);
+  }
+  fclose(fp);
 
-  places["Modulus"]=&rsa->N;
-  places["PublicExponent"]=&rsa->E;
-  places["PrivateExponent"]=&rsa->D;
-  places["Prime1"]=&rsa->P;
-  places["Prime2"]=&rsa->Q;
-  places["Exponent1"]=&rsa->DP;
-  places["Exponent2"]=&rsa->DQ;
-  places["Coefficient"]=&rsa->QP;
+  switch(algorithm) {
+    case 5:
+    case 7:
+    case 8:
+    case 10:
+      return RSADNSPrivateKey::fromISCString(drc, isc);
+      break;
+    default: 
+      throw runtime_error("Unknown DNSSEC signature algorithm number "+lexical_cast<string>(algorithm));
+      break;
+  }
+  return 0;
+}
 
-  unsigned char decoded[1024];
-  DNSKEYRecordContent drc;
-  string modulus, exponent;
-  while(stringfgets(fp, sline)) {
+DNSPrivateKey* DNSPrivateKey::fromISCString(DNSKEYRecordContent& drc, const std::string& content)
+{
+  int algorithm = 0;
+  string sline, key, value;
+  istringstream str(content);
+  while(getline(str, sline)) {
     tie(key,value)=splitField(sline, ':');
-    trim(value);
-    trim(key);
-    if(key.empty())
-      continue;
-    if(places.count(key)) {
-      if(places[key]) {
-        int len=sizeof(decoded);
-        if(base64_decode(decoded, &len, (unsigned char*)value.c_str(), value.length()) < 0) {
-          cerr<<"Error base64 decoding '"<<value<<"'\n";
-          exit(1);
-        }
-        //	B64Decode(value, decoded);
-        //	cerr<<key<<" decoded.length(): "<<8*len<<endl;
-        mpi_read_binary(places[key], decoded, len);
-        if(key=="Modulus")
-          modulus.assign((const char*)decoded,len);
-        if(key=="PublicExponent")
-          exponent.assign((const char*)decoded,len);
-      }
-    }
-    else {
-      if(key=="Algorithm") {
-        drc.d_algorithm = atoi(value.c_str());
-      }
-      else if(key != "Private-key-format")
-        cerr<<"Unknown field '"<<key<<"'\n";
+    if(pdns_iequals(key,"algorithm")) {
+      algorithm = atoi(value.c_str());
+      break;
     }
   }
-  rsa->len = ( mpi_msb( &rsa->N ) + 7 ) >> 3; // no clue what this does
-
-  if(exponent.length() < 255) 
-    drc.d_key.assign(1, (char) (unsigned int) exponent.length());
-  else {
-    drc.d_key.assign(1, 0);
-    uint16_t len=htons(exponent.length());
-    drc.d_key.append((char*)&len, 2);
+  switch(algorithm) {
+    case 5:
+    case 7:
+    case 8:
+    case 10:
+      return RSADNSPrivateKey::fromISCString(drc, content);
+      break;
+    default: 
+      throw runtime_error("Unknown DNSSEC signature algorithm number "+lexical_cast<string>(algorithm));
+      break;
   }
-  drc.d_key.append(exponent);
-  drc.d_key.append(modulus);
-  drc.d_protocol=3;
-  fclose(fp);
-  return drc;
+  return 0;
 }
 
-DNSKEYRecordContent getRSAKeyFromISCString(rsa_context* rsa, const std::string& content)
+DNSPrivateKey* RSADNSPrivateKey::fromISCString(DNSKEYRecordContent& drc, const std::string& content)
 {
+  RSADNSPrivateKey* ret = new RSADNSPrivateKey();
+  
   string sline;
   string key,value;
   map<string, mpi*> places;
-
   
-  rsa_init(rsa, RSA_PKCS_V15, 0, NULL, NULL );
+  rsa_init(&ret->d_context, RSA_PKCS_V15, 0, NULL, NULL );
 
-  places["Modulus"]=&rsa->N;
-  places["PublicExponent"]=&rsa->E;
-  places["PrivateExponent"]=&rsa->D;
-  places["Prime1"]=&rsa->P;
-  places["Prime2"]=&rsa->Q;
-  places["Exponent1"]=&rsa->DP;
-  places["Exponent2"]=&rsa->DQ;
-  places["Coefficient"]=&rsa->QP;
+  places["Modulus"]=&ret->d_context.N;
+  places["PublicExponent"]=&ret->d_context.E;
+  places["PrivateExponent"]=&ret->d_context.D;
+  places["Prime1"]=&ret->d_context.P;
+  places["Prime2"]=&ret->d_context.Q;
+  places["Exponent1"]=&ret->d_context.DP;
+  places["Exponent2"]=&ret->d_context.DQ;
+  places["Coefficient"]=&ret->d_context.QP;
 
-  DNSKEYRecordContent drc;
   string modulus, exponent;
   istringstream str(content);
   unsigned char decoded[1024];
@@ -208,7 +209,7 @@ DNSKEYRecordContent getRSAKeyFromISCString(rsa_context* rsa, const std::string&
         cerr<<"Unknown field '"<<key<<"'\n";
     }
   }
-  rsa->len = ( mpi_msb( &rsa->N ) + 7 ) >> 3; // no clue what this does
+  ret->d_context.len = ( mpi_msb( &ret->d_context.N ) + 7 ) >> 3; // no clue what this does
 
   if(exponent.length() < 255) 
     drc.d_key.assign(1, (char) (unsigned int) exponent.length());
@@ -221,28 +222,34 @@ DNSKEYRecordContent getRSAKeyFromISCString(rsa_context* rsa, const std::string&
   drc.d_key.append(modulus);
   drc.d_protocol=3;
   
-  return drc;
+  return ret;
+}
+
+DNSPrivateKey* DNSPrivateKey::fromPEMString(DNSKEYRecordContent& drc, const std::string& raw)
+{
+  return RSADNSPrivateKey::fromPEMString(drc, raw);
 }
 
-DNSKEYRecordContent getRSAKeyFromPEMString(rsa_context* rsa, const std::string& raw)
+DNSPrivateKey* RSADNSPrivateKey::fromPEMString(DNSKEYRecordContent& drc, const std::string& raw)
 {
   vector<string> integers;
   decodeDERIntegerSequence(raw, integers);
   cerr<<"Got "<<integers.size()<<" integers"<<endl; 
   map<int, mpi*> places;
   
-  rsa_init(rsa, RSA_PKCS_V15, 0, NULL, NULL );
+  RSADNSPrivateKey* ret = new RSADNSPrivateKey;
+  
+  rsa_init(&ret->d_context, RSA_PKCS_V15, 0, NULL, NULL );
 
-  places[1]=&rsa->N;
-  places[2]=&rsa->E;
-  places[3]=&rsa->D;
-  places[4]=&rsa->P;
-  places[5]=&rsa->Q;
-  places[6]=&rsa->DP;
-  places[7]=&rsa->DQ;
-  places[8]=&rsa->QP;
+  places[1]=&ret->d_context.N;
+  places[2]=&ret->d_context.E;
+  places[3]=&ret->d_context.D;
+  places[4]=&ret->d_context.P;
+  places[5]=&ret->d_context.Q;
+  places[6]=&ret->d_context.DP;
+  places[7]=&ret->d_context.DQ;
+  places[8]=&ret->d_context.QP;
 
-  DNSKEYRecordContent drc;
   string modulus, exponent;
   
   for(int n = 0; n < 9 ; ++n) {
@@ -256,7 +263,7 @@ DNSKEYRecordContent getRSAKeyFromPEMString(rsa_context* rsa, const std::string&
       }
     }
   }
-  rsa->len = ( mpi_msb( &rsa->N ) + 7 ) >> 3; // no clue what this does
+  ret->d_context.len = ( mpi_msb( &ret->d_context.N ) + 7 ) >> 3; // no clue what this does
 
   if(exponent.length() < 255) 
     drc.d_key.assign(1, (char) (unsigned int) exponent.length());
@@ -269,10 +276,9 @@ DNSKEYRecordContent getRSAKeyFromPEMString(rsa_context* rsa, const std::string&
   drc.d_key.append(modulus);
   drc.d_protocol=3;
   
-  return drc;
+  return ret;
 }
 
-
 void makeRSAPublicKeyFromDNS(rsa_context* rc, const DNSKEYRecordContent& dkrc)
 {
   rsa_init(rc, RSA_PKCS_V15, 0, NULL, NULL );
@@ -340,34 +346,39 @@ DSRecordContent makeDSFromDNSKey(const std::string& qname, const DNSKEYRecordCon
   return dsrc;
 }
 
-DNSKEYRecordContent makeDNSKEYFromRSAKey(const rsa_context* rc, uint8_t algorithm, uint16_t flags)
+string RSADNSPrivateKey::getPublicKeyString()  const
 {
-  DNSKEYRecordContent drc;
-  char tmp[max(mpi_size(&rc->E), mpi_size(&rc->N))];
-
-  //  cerr<<"in makeDNSKEY rsa_check_pubkey: "<<rsa_check_pubkey(rc)<<", bits="<<mpi_size(&rc->N)*8<<endl;
+  string keystring;
+  char tmp[max(mpi_size(&d_context.E), mpi_size(&d_context.N))];
 
-  mpi_write_binary(&rc->E, (unsigned char*)tmp, mpi_size(&rc->E) );
-  string exponent((char*)tmp, mpi_size(&rc->E));
+  mpi_write_binary(&d_context.E, (unsigned char*)tmp, mpi_size(&d_context.E) );
+  string exponent((char*)tmp, mpi_size(&d_context.E));
 
-  mpi_write_binary(&rc->N, (unsigned char*)tmp, mpi_size(&rc->N) );
-  string modulus((char*)tmp, mpi_size(&rc->N));
+  mpi_write_binary(&d_context.N, (unsigned char*)tmp, mpi_size(&d_context.N) );
+  string modulus((char*)tmp, mpi_size(&d_context.N));
 
   if(exponent.length() < 255) 
-    drc.d_key.assign(1, (char) (unsigned int) exponent.length());
+    keystring.assign(1, (char) (unsigned int) exponent.length());
   else {
-    drc.d_key.assign(1, 0);
+    keystring.assign(1, 0);
     uint16_t len=htons(exponent.length());
-    drc.d_key.append((char*)&len, 2);
+    keystring.append((char*)&len, 2);
   }
-  drc.d_key.append(exponent);
-  drc.d_key.append(modulus);
+  keystring.append(exponent);
+  keystring.append(modulus);
+  return keystring;
+}
+
+DNSKEYRecordContent makeDNSKEYFromRSAKey(const DNSPrivateKey* pk, uint8_t algorithm, uint16_t flags)
+{
+  DNSKEYRecordContent drc;
+  
 
   drc.d_protocol=3;
   drc.d_algorithm = algorithm;
 
   drc.d_flags=flags;
-
+  drc.d_key = pk->getPublicKeyString();
   return drc;
 }
 
@@ -414,7 +425,7 @@ std::string hashQNameWithSalt(unsigned int times, const std::string& salt, const
 }
 DNSKEYRecordContent DNSSECPrivateKey::getDNSKEY() const
 {
-  return makeDNSKEYFromRSAKey(&d_key.getConstContext(), d_algorithm, d_flags);
+  return makeDNSKEYFromRSAKey(getKey(), d_algorithm, d_flags);
 }
 
 class DEREater
diff --git a/pdns/dnssecinfra.hh b/pdns/dnssecinfra.hh
index 643c9de2b2..99277c9f7d 100644
--- a/pdns/dnssecinfra.hh
+++ b/pdns/dnssecinfra.hh
@@ -17,29 +17,44 @@ inline bool operator<(const mpi& a, const mpi& b)
   return mpi_cmp_mpi(&a, &b) < 0;
 }
 
-class RSAContext
+class DNSPrivateKey
+{
+  public:
+    virtual void create(unsigned int bits)=0;
+    virtual std::string convertToISC(unsigned int algorithm) const =0;
+    virtual std::string getPubKeyHash()const =0;
+    virtual std::string sign(const std::string& hash) const =0;
+    virtual std::string getPublicKeyString()const =0;
+    virtual int getBits() const =0;
+    
+  static DNSPrivateKey* fromISCFile(DNSKEYRecordContent& drc, const char* fname);
+  static DNSPrivateKey* fromISCString(DNSKEYRecordContent& drc, const std::string& content);
+  static DNSPrivateKey* fromPEMString(DNSKEYRecordContent& drc, const std::string& raw);
+};
+
+class RSADNSPrivateKey : public DNSPrivateKey
 {
 public:
-  RSAContext()
+  RSADNSPrivateKey()
   {
     memset(&d_context, 0, sizeof(d_context));
     PDNSSEC_MI(N); 
     PDNSSEC_MI(E); PDNSSEC_MI(D); PDNSSEC_MI(P); PDNSSEC_MI(Q); PDNSSEC_MI(DP); PDNSSEC_MI(DQ); PDNSSEC_MI(QP); PDNSSEC_MI(RN); PDNSSEC_MI(RP); PDNSSEC_MI(RQ);
   }
 
-  ~RSAContext()
+  ~RSADNSPrivateKey()
   {
     PDNSSEC_MF(N); 
     PDNSSEC_MF(E); PDNSSEC_MF(D); PDNSSEC_MF(P); PDNSSEC_MF(Q); PDNSSEC_MF(DP); PDNSSEC_MF(DQ); PDNSSEC_MF(QP); PDNSSEC_MF(RN); PDNSSEC_MF(RP); PDNSSEC_MF(RQ);
   }
 
-  bool operator<(const RSAContext& rhs) const
+  bool operator<(const RSADNSPrivateKey& rhs) const
   {
     return tie(d_context.N, d_context.E, d_context.D, d_context.P, d_context.Q, d_context.DP, d_context.DQ, d_context.QP)
     < tie(rhs.d_context.N, rhs.d_context.E, rhs.d_context.D, rhs.d_context.P, rhs.d_context.Q, rhs.d_context.DP, rhs.d_context.DQ, rhs.d_context.QP);
   }
 
-  RSAContext(const RSAContext& orig) 
+  RSADNSPrivateKey(const RSADNSPrivateKey& orig) 
   {
     d_context.ver = orig.d_context.ver;
     d_context.len = orig.d_context.len;
@@ -53,7 +68,7 @@ public:
     PDNSSEC_MC(E); PDNSSEC_MC(D); PDNSSEC_MC(P); PDNSSEC_MC(Q); PDNSSEC_MC(DP); PDNSSEC_MC(DQ); PDNSSEC_MC(QP); PDNSSEC_MC(RN); PDNSSEC_MC(RP); PDNSSEC_MC(RQ);
   }
 
-  RSAContext& operator=(const RSAContext& orig) 
+  RSADNSPrivateKey& operator=(const RSADNSPrivateKey& orig) 
   {
     d_context.ver = orig.d_context.ver;
     d_context.len = orig.d_context.len;
@@ -83,7 +98,16 @@ public:
 
   void create(unsigned int bits);
   std::string convertToISC(unsigned int algorithm) const;
-  std::string getPubKeyHash();
+  std::string getPubKeyHash() const;
+  std::string sign(const std::string& hash) const; 
+  std::string getPublicKeyString() const;
+  int getBits() const
+  {
+    return mpi_size(&d_context.N)*8;
+  }
+  static DNSPrivateKey* fromISCString(DNSKEYRecordContent& drc, const std::string& content);
+  static DNSPrivateKey* fromPEMString(DNSKEYRecordContent& drc, const std::string& raw);
+
 private:
   rsa_context d_context;
 };
@@ -97,10 +121,21 @@ struct DNSSECPrivateKey
 {
   uint16_t getTag();
   
-  RSAContext d_key;
+  const DNSPrivateKey* getKey() const
+  {
+    return d_key.get();
+  }
+  
+  void setKey(const shared_ptr<DNSPrivateKey> key)
+  {
+    d_key = key;
+  }
   DNSKEYRecordContent getDNSKEY() const;
   uint8_t d_algorithm;
   uint16_t d_flags;
+  
+private:
+  shared_ptr<DNSPrivateKey> d_key;
 };
 
 
diff --git a/pdns/dnssecsigner.cc b/pdns/dnssecsigner.cc
index 3d0f0144a6..4975c3c3f9 100644
--- a/pdns/dnssecsigner.cc
+++ b/pdns/dnssecsigner.cc
@@ -109,14 +109,13 @@ static map<pair<string, string>, string> g_signatures;
 
 void fillOutRRSIG(DNSSECPrivateKey& dpk, const std::string& signQName, RRSIGRecordContent& rrc, vector<shared_ptr<DNSRecordContent> >& toSign) 
 {
-  DNSKEYRecordContent drc= dpk.getDNSKEY(); 
-  RSAContext& rc = dpk.d_key;
+  DNSKEYRecordContent drc = dpk.getDNSKEY(); 
+  const DNSPrivateKey* rc = dpk.getKey();
   rrc.d_tag = drc.getTag();
   rrc.d_algorithm = drc.d_algorithm;
   string realhash=getHashForRRSET(signQName, rrc, toSign); // this is what we sign
 
-  unsigned char signature[mpi_size(&rc.getContext().N)];
-  pair<string, string> lookup(rc.getPubKeyHash(), realhash);
+  pair<string, string> lookup(rc->getPubKeyHash(), realhash);
   
   {
     Lock l(&g_signatures_lock);
@@ -129,17 +128,7 @@ void fillOutRRSIG(DNSSECPrivateKey& dpk, const std::string& signQName, RRSIGReco
       ; // cerr<<"Miss!"<<endl;
   }
   
-  int ret=rsa_pkcs1_sign(&rc.getContext(), RSA_PRIVATE, 
-    rrc.d_algorithm < 8 ? SIG_RSA_SHA1 : SIG_RSA_SHA256, 
-    rrc.d_algorithm < 8 ? 20 : 32,
-    (unsigned char*) realhash.c_str(), signature);
-  
-  if(ret!=0) {
-    cerr<<"signing returned: "<<ret<<endl;
-    exit(1);
-  }
-  
-  rrc.d_signature.assign((char*)signature, sizeof(signature));
+  rrc.d_signature = rc->sign(realhash);
 
   Lock l(&g_signatures_lock);
   g_signatures[lookup] = rrc.d_signature;
diff --git a/pdns/nsecrecords.cc b/pdns/nsecrecords.cc
index bda4b250b2..670c755b0e 100644
--- a/pdns/nsecrecords.cc
+++ b/pdns/nsecrecords.cc
@@ -65,9 +65,9 @@ NSECRecordContent::DNSRecordContent* NSECRecordContent::make(const DNSRecord &dr
   
   for(unsigned int n=0 ; n < len ; ++n) {
     uint8_t val=bitmap[2+n];
-    for(int bit = 0; bit < 8 ; ++bit , val>>=1)
+    for(int bit = 0; bit < 8 ; ++bit , val>>=1) 
       if(val & 1) {
-	ret->d_set.insert((7-bit) + 8*(n));
+        ret->d_set.insert((7-bit) + 8*(n));
       }
   }
   
diff --git a/pdns/pdnssec.cc b/pdns/pdnssec.cc
index ca3e51413e..500112e080 100644
--- a/pdns/pdnssec.cc
+++ b/pdns/pdnssec.cc
@@ -200,7 +200,7 @@ void showZone(DNSSECKeeper& dk, const std::string& zone)
     cout << "keys: "<<endl;
     BOOST_FOREACH(DNSSECKeeper::keyset_t::value_type value, keyset) {
       cout<<"ID = "<<value.second.id<<" ("<<(value.second.keyOrZone ? "KSK" : "ZSK")<<"), tag = "<<value.first.getDNSKEY().getTag();
-      cout<<", algo = "<<(int)value.first.d_algorithm<<", bits = "<<value.first.d_key.getConstContext().len*8<<"\tActive: "<<value.second.active<< endl; // humanTime(value.second.beginValidity)<<" - "<<humanTime(value.second.endValidity)<<endl;
+      cout<<", algo = "<<(int)value.first.d_algorithm<<", bits = "<<value.first.getKey()->getBits()<<"\tActive: "<<value.second.active<< endl; // humanTime(value.second.beginValidity)<<" - "<<humanTime(value.second.endValidity)<<endl;
       if(value.second.keyOrZone) {
         cout<<"KSK DNSKEY = "<<zone<<" IN DNSKEY "<< value.first.getDNSKEY().getZoneRepresentation() << endl;
         cout<<"DS = "<<zone<<" IN DS "<<makeDSFromDNSKey(zone, value.first.getDNSKEY(), 1).getZoneRepresentation() << endl;
@@ -413,7 +413,7 @@ try
     string zone=cmds[1];
     unsigned int id=atoi(cmds[2].c_str());
     DNSSECPrivateKey dpk=dk.getKeyById(zone, id);
-    cout << dpk.d_key.convertToISC(dpk.d_algorithm) <<endl;
+    cout << dpk.getKey()->convertToISC(dpk.d_algorithm) <<endl;
   }  
   else if(cmds[0]=="import-zone-key-pem") {
     if(cmds.size() < 4) {
@@ -433,7 +433,9 @@ try
     }
     B64Decode(interim, raw);
     DNSSECPrivateKey dpk;
-    getRSAKeyFromPEMString(&dpk.d_key.getContext(), raw);
+    DNSKEYRecordContent drc;
+    shared_ptr<DNSPrivateKey> key(DNSPrivateKey::fromPEMString(drc, raw));
+    dpk.setKey(key);
     
     dpk.d_algorithm = atoi(cmds[3].c_str());
     
@@ -466,7 +468,9 @@ try
     string zone=cmds[1];
     string fname=cmds[2];
     DNSSECPrivateKey dpk;
-    DNSKEYRecordContent drc = getRSAKeyFromISC(&dpk.d_key.getContext(), fname.c_str());
+    DNSKEYRecordContent drc;
+    shared_ptr<DNSPrivateKey> key(DNSPrivateKey::fromISCFile(drc, fname.c_str()));
+    dpk.setKey(key);
     dpk.d_algorithm = drc.d_algorithm;
     
     if(dpk.d_algorithm == 7)