9a769d8b16eb4e3d088ba1e5bd6ccb65504e1c9eTinderbox User - Copyright (C) 2010, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - This Source Code Form is subject to the terms of the Mozilla Public
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - License, v. 2.0. If a copy of the MPL was not distributed with this
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - file, You can obtain one at http://mozilla.org/MPL/2.0/.
6715db6593ce9a271ac3131cd7a886feaa386a2eEvan Hunt<!-- Converted by db4-upgrade version 1.0 -->
83a28ca274521e15086fc39febde507bcc4e145eMark Andrews<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.isc-hmac-fixup">
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt <refentryinfo>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt </refentryinfo>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt <refentrytitle><application>isc-hmac-fixup</application></refentrytitle>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt <refnamediv>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt <refname><application>isc-hmac-fixup</application></refname>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt <refpurpose>fixes HMAC keys generated by older versions of BIND</refpurpose>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt </refnamediv>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt </copyright>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt <refsynopsisdiv>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="req" rep="norepeat"><replaceable class="parameter">algorithm</replaceable></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="req" rep="norepeat"><replaceable class="parameter">secret</replaceable></arg>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt </cmdsynopsis>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt </refsynopsisdiv>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <refsection><info><title>DESCRIPTION</title></info>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt Versions of BIND 9 up to and including BIND 9.6 had a bug causing
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt HMAC-SHA* TSIG keys which were longer than the digest length of the
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt longer than 256 bits, etc) to be used incorrectly, generating a
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt message authentication code that was incompatible with other DNS
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt implementations.
17b7c609028e5acb847b6f78833d008f820daa5dEvan Hunt This bug was fixed in BIND 9.7. However, the fix may
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt cause incompatibility between older and newer versions of
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt BIND, when using long keys. <command>isc-hmac-fixup</command>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt modifies those keys to restore compatibility.
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt To modify a key, run <command>isc-hmac-fixup</command> and
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt specify the key's algorithm and secret on the command line. If the
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt secret is longer than the digest length of the algorithm (64 bytes
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt new secret will be generated consisting of a hash digest of the old
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt secret. (If the secret did not require conversion, then it will be
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt printed without modification.)
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </refsection>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <refsection><info><title>SECURITY CONSIDERATIONS</title></info>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt Secrets that have been converted by <command>isc-hmac-fixup</command>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt are shortened, but as this is how the HMAC protocol works in
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt operation anyway, it does not affect security. RFC 2104 notes,
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt "Keys longer than [the digest length] are acceptable but the
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt extra length would not significantly increase the function
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </refsection>
0f66aced2640d964aeb6db41210711ba0640d7f2Evan Hunt <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </refsection>