man.isc-hmac-fixup.html revision 3c9cf7efb97991f9871bc5633e7ed1cae0932a37
1506e77ef38e9fed0fc0b180ee505b6a02ca98f3slive - Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC")
1506e77ef38e9fed0fc0b180ee505b6a02ca98f3slive - Copyright (C) 2000-2003 Internet Software Consortium.
1506e77ef38e9fed0fc0b180ee505b6a02ca98f3slive - Permission to use, copy, modify, and/or distribute this software for any
1506e77ef38e9fed0fc0b180ee505b6a02ca98f3slive - purpose with or without fee is hereby granted, provided that the above
5a58787efeb02a1c3f06569d019ad81fd2efa06end - copyright notice and this permission notice appear in all copies.
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
5a58787efeb02a1c3f06569d019ad81fd2efa06end - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
5a58787efeb02a1c3f06569d019ad81fd2efa06end - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim - PERFORMANCE OF THIS SOFTWARE.
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim<!-- $Id: man.isc-hmac-fixup.html,v 1.68 2012/01/16 01:14:56 tbox Exp $ -->
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
3b3b7fc78d1f5bfc2769903375050048ff41ff26nd<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim<link rel="prev" href="man.genrandom.html" title="genrandom">
7f5b59ccc63c0c0e3e678a168f09ee6a2f51f9d0nd<link rel="next" href="man.nsec3hash.html" title="nsec3hash">
63f06dce77bb2d9b1c5aa5deeb47a1069987fd1end<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
02b39e6d8d0bf5fc0014bb1b4826b05db879ddafnd<tr><th colspan="3" align="center"><span class="application">isc-hmac-fixup</span></th></tr>
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim<td width="20%" align="right">�<a accesskey="n" href="man.nsec3hash.html">Next</a>
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim<a name="man.isc-hmac-fixup"></a><div class="titlepage"></div>
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim<p><span class="application">isc-hmac-fixup</span> — fixes HMAC keys generated by older versions of BIND</p>
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim<div class="cmdsynopsis"><p><code class="command">isc-hmac-fixup</code> {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>secret</code></em>}</p></div>
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd Versions of BIND 9 up to and including BIND 9.6 had a bug causing
a12dd6260a66f51e25119982390def72e2db4be5nd HMAC-SHA* TSIG keys which were longer than the digest length of the
a63f0ab647ad2ab72efc9bea7a66e24e9ebc5cc2nd hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim longer than 256 bits, etc) to be used incorrectly, generating a
a63f0ab647ad2ab72efc9bea7a66e24e9ebc5cc2nd message authentication code that was incompatible with other DNS
a63f0ab647ad2ab72efc9bea7a66e24e9ebc5cc2nd implementations.
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd This bug has been fixed in BIND 9.7. However, the fix may
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd cause incompatibility between older and newer versions of
a7f09af958b9b0cd7e3d90a63ede010e7238d4f1nd BIND, when using long keys. <span><strong class="command">isc-hmac-fixup</strong></span>
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd modifies those keys to restore compatibility.
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd To modify a key, run <span><strong class="command">isc-hmac-fixup</strong></span> and
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd specify the key's algorithm and secret on the command line. If the
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd secret is longer than the digest length of the algorithm (64 bytes
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd new secret will be generated consisting of a hash digest of the old
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd secret. (If the secret did not require conversion, then it will be
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd printed without modification.)
aedd0bf93c729eb723b1eeffccf46bf0117ff0ederikabele<a name="id2618092"></a><h2>SECURITY CONSIDERATIONS</h2>
a63f0ab647ad2ab72efc9bea7a66e24e9ebc5cc2nd Secrets that have been converted by <span><strong class="command">isc-hmac-fixup</strong></span>
7add1372edb1ee95a2c4d1314df4c7567bda7c62jim are shortened, but as this is how the HMAC protocol works in
a63f0ab647ad2ab72efc9bea7a66e24e9ebc5cc2nd operation anyway, it does not affect security. RFC 2104 notes,
a63f0ab647ad2ab72efc9bea7a66e24e9ebc5cc2nd "Keys longer than [the digest length] are acceptable but the
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd extra length would not significantly increase the function
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd strength."
a63f0ab647ad2ab72efc9bea7a66e24e9ebc5cc2nd <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
d37a47f683d959ca24a0482b305b20582155da7ajim<p><span class="corpauthor">Internet Systems Consortium</span>
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
8a72c24379e10c3f3d0dfe352bf15e45ee65c179nd<td width="40%" align="right">�<a accesskey="n" href="man.nsec3hash.html">Next</a>
a63f0ab647ad2ab72efc9bea7a66e24e9ebc5cc2nd<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
b9b166bce28378f88ecba40c17f788f510b8357and<td width="40%" align="right" valign="top">�<span class="application">nsec3hash</span>