From ea648e70a989cca190cd7403fe892fd2dcc290b4 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 5 May 2024 20:37:14 +0200 Subject: Adding upstream version 1:9.11.5.P4+dfsg. Signed-off-by: Daniel Baumann --- bin/tools/isc-hmac-fixup.html | 92 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 bin/tools/isc-hmac-fixup.html (limited to 'bin/tools/isc-hmac-fixup.html') diff --git a/bin/tools/isc-hmac-fixup.html b/bin/tools/isc-hmac-fixup.html new file mode 100644 index 0000000..dc1bb8a --- /dev/null +++ b/bin/tools/isc-hmac-fixup.html @@ -0,0 +1,92 @@ + + + + + +isc-hmac-fixup + + +
+
+ + + + + +
+

Name

+

+ isc-hmac-fixup + — fixes HMAC keys generated by older versions of BIND +

+
+ + + +
+

Synopsis

+

+ isc-hmac-fixup + {algorithm} + {secret} +

+
+ +
+

DESCRIPTION

+ +

+ Versions of BIND 9 up to and including BIND 9.6 had a bug causing + HMAC-SHA* TSIG keys which were longer than the digest length of the + hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys + longer than 256 bits, etc) to be used incorrectly, generating a + message authentication code that was incompatible with other DNS + implementations. +

+

+ This bug was fixed in BIND 9.7. However, the fix may + cause incompatibility between older and newer versions of + BIND, when using long keys. isc-hmac-fixup + modifies those keys to restore compatibility. +

+

+ To modify a key, run isc-hmac-fixup and + specify the key's algorithm and secret on the command line. If the + secret is longer than the digest length of the algorithm (64 bytes + for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a + new secret will be generated consisting of a hash digest of the old + secret. (If the secret did not require conversion, then it will be + printed without modification.) +

+
+ +
+

SECURITY CONSIDERATIONS

+ +

+ Secrets that have been converted by isc-hmac-fixup + are shortened, but as this is how the HMAC protocol works in + operation anyway, it does not affect security. RFC 2104 notes, + "Keys longer than [the digest length] are acceptable but the + extra length would not significantly increase the function + strength." +

+
+ +
+

SEE ALSO

+ +

+ BIND 9 Administrator Reference Manual, + RFC 2104. +

+
+ +
+ -- cgit v1.2.3