Commit 947f00f22b for bind

commit 947f00f22b5fa05154bd6e2db605b4a41103ec67
Author: Martin Basti <mbasti@isc.org>
Date:   Mon Nov 2 16:52:42 2026 +0000

    Restore the 1024-bit minimum RSA key length in dnssec-policy

    Commit e0ca243a93 lowered the non-FIPS minimum to 512 bits for all RSA
    algorithms except RSASHA512. That was wrong. Use minimum 1024 for
    all RSA algorithms outside FIPS mode.

diff --git a/lib/isccfg/kaspconf.c b/lib/isccfg/kaspconf.c
index 1002542b82..3b1913d83c 100644
--- a/lib/isccfg/kaspconf.c
+++ b/lib/isccfg/kaspconf.c
@@ -329,16 +329,9 @@ cfg_kaspkey_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp,
 			case DST_ALG_RSASHA512:
 			case DST_ALG_RSASHA256PRIVATEOID:
 			case DST_ALG_RSASHA512PRIVATEOID:
+				min = 1024;
 				if (isc_crypto_fips_mode()) {
 					min = 2048;
-				} else if (key->algorithm ==
-						   DST_ALG_RSASHA512 ||
-					   key->algorithm ==
-						   DST_ALG_RSASHA512PRIVATEOID)
-				{
-					min = 1024;
-				} else {
-					min = 512;
 				}
 				if (size < min || size > 4096) {
 					if (log_errors) {
diff --git a/tests/isccfg/kaspconf_test.c b/tests/isccfg/kaspconf_test.c
index 678607300c..a2320109a7 100644
--- a/tests/isccfg/kaspconf_test.c
+++ b/tests/isccfg/kaspconf_test.c
@@ -109,17 +109,21 @@ ISC_RUN_TEST_IMPL(kaspkey_rsa_length) {
 		const char *conftext;
 		isc_result_t expected;
 	} testcases[] = {
-		/* The minimum for RSASHA512 based algorithms is 1024... */
-		{ CSK_POLICY("rsasha512 512"), ISC_R_RANGE },
+		/* The minimum for all RSA algorithms is 1024. */
+		{ CSK_POLICY("rsasha512 1023"), ISC_R_RANGE },
 		{ CSK_POLICY("rsasha512 1024"), ISC_R_SUCCESS },
-		{ CSK_POLICY("rsasha512oid 512"), ISC_R_RANGE },
+		{ CSK_POLICY("rsasha512oid 1023"), ISC_R_RANGE },
 		{ CSK_POLICY("rsasha512oid 1024"), ISC_R_SUCCESS },
-		/* ...but 512 for the other RSA algorithms. */
-		{ CSK_POLICY("rsasha256 512"), ISC_R_SUCCESS },
-		{ CSK_POLICY("rsasha256 511"), ISC_R_RANGE },
-		{ CSK_POLICY("rsasha256oid 512"), ISC_R_SUCCESS },
-		{ CSK_POLICY("rsasha1 512"), ISC_R_SUCCESS },
+		{ CSK_POLICY("rsasha256 1023"), ISC_R_RANGE },
+		{ CSK_POLICY("rsasha256 1024"), ISC_R_SUCCESS },
+		{ CSK_POLICY("rsasha256oid 1023"), ISC_R_RANGE },
+		{ CSK_POLICY("rsasha256oid 1024"), ISC_R_SUCCESS },
+		{ CSK_POLICY("rsasha1 1023"), ISC_R_RANGE },
+		{ CSK_POLICY("rsasha1 1024"), ISC_R_SUCCESS },
+		{ CSK_POLICY("nsec3rsasha1 1023"), ISC_R_RANGE },
+		{ CSK_POLICY("nsec3rsasha1 1024"), ISC_R_SUCCESS },
 		/* The maximum is 4096 for all of them. */
+		{ CSK_POLICY("rsasha256 4096"), ISC_R_SUCCESS },
 		{ CSK_POLICY("rsasha256 4097"), ISC_R_RANGE },
 	};