man.isc-hmac-fixup.html revision 65ad89971ee9973074cd11c207af92bf5440df01
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana - Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana - Copyright (C) 2000-2003 Internet Software Consortium.
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana - Permission to use, copy, modify, and/or distribute this software for any
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana - purpose with or without fee is hereby granted, provided that the above
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana - copyright notice and this permission notice appear in all copies.
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana - PERFORMANCE OF THIS SOFTWARE.
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<!-- $Id: man.isc-hmac-fixup.html,v 1.30 2011/01/08 01:15:43 tbox Exp $ -->
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<link rel="prev" href="man.genrandom.html" title="genrandom">
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<link rel="next" href="man.nsec3hash.html" title="nsec3hash">
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<table width="100%" summary="Navigation header">
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<tr><th colspan="3" align="center"><span class="application">isc-hmac-fixup</span></th></tr>
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<a accesskey="p" href="man.genrandom.html">Prev</a>�</td>
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<th width="60%" align="center">Manual pages</th>
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<td width="20%" align="right">�<a accesskey="n" href="man.nsec3hash.html">Next</a>
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<a name="man.isc-hmac-fixup"></a><div class="titlepage"></div>
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<p><span class="application">isc-hmac-fixup</span> — fixes HMAC keys generated by older versions of BIND</p>
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<div class="cmdsynopsis"><p><code class="command">isc-hmac-fixup</code> {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>secret</code></em>}</p></div>
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana<a name="id2615901"></a><h2>DESCRIPTION</h2>
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana Versions of BIND 9 up to and including BIND 9.6 had a bug causing
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana HMAC-SHA* TSIG keys which were longer than the digest length of the
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana longer than 256 bits, etc) to be used incorrectly, generating a
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana message authentication code that was incompatible with other DNS
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana implementations.
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana This bug has been fixed in BIND 9.7. However, the fix may
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana cause incompatibility between older and newer versions of
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana BIND, when using long keys. <span><strong class="command">isc-hmac-fixup</strong></span>
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana modifies those keys to restore compatibility.
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana To modify a key, run <span><strong class="command">isc-hmac-fixup</strong></span> and
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana specify the key's algorithm and secret on the command line. If the
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana secret is longer than the digest length of the algorithm (64 bytes
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
56b2bdd1f04d465cfe4a95b88ae5cba5884154e4Gireesh Nagabhushana new secret will be generated consisting of a hash digest of the old