man.isc-hmac-fixup.html revision 7911e6f9de303bca5a3d8b34f4330c8f7cecffae
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - Copyright (C) 2000-2016 Internet Systems Consortium, Inc. ("ISC")
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - This Source Code Form is subject to the terms of the Mozilla Public
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - License, v. 2.0. If a copy of the MPL was not distributed with this
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - file, You can obtain one at http://mozilla.org/MPL/2.0/.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="prev" href="man.genrandom.html" title="genrandom">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="next" href="man.nsec3hash.html" title="nsec3hash">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<table width="100%" summary="Navigation header">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<tr><th colspan="3" align="center"><span class="application">isc-hmac-fixup</span></th></tr>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a accesskey="p" href="man.genrandom.html">Prev</a>�</td>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<th width="60%" align="center">Manual pages</th>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<td width="20%" align="right">�<a accesskey="n" href="man.nsec3hash.html">Next</a>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a name="man.isc-hmac-fixup"></a><div class="titlepage"></div>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span class="application">isc-hmac-fixup</span>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster — fixes HMAC keys generated by older versions of BIND
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster {<em class="replaceable"><code>algorithm</code></em>}
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster {<em class="replaceable"><code>secret</code></em>}
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Versions of BIND 9 up to and including BIND 9.6 had a bug causing
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster HMAC-SHA* TSIG keys which were longer than the digest length of the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster longer than 256 bits, etc) to be used incorrectly, generating a
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster message authentication code that was incompatible with other DNS
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster implementations.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster This bug has been fixed in BIND 9.7. However, the fix may
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster cause incompatibility between older and newer versions of
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster BIND, when using long keys. <span class="command"><strong>isc-hmac-fixup</strong></span>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster modifies those keys to restore compatibility.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster To modify a key, run <span class="command"><strong>isc-hmac-fixup</strong></span> and
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster specify the key's algorithm and secret on the command line. If the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster secret is longer than the digest length of the algorithm (64 bytes
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster new secret will be generated consisting of a hash digest of the old
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster secret. (If the secret did not require conversion, then it will be
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster printed without modification.)
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a name="id-1.14.34.8"></a><h2>SECURITY CONSIDERATIONS</h2>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Secrets that have been converted by <span class="command"><strong>isc-hmac-fixup</strong></span>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster are shortened, but as this is how the HMAC protocol works in
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster operation anyway, it does not affect security. RFC 2104 notes,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "Keys longer than [the digest length] are acceptable but the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster extra length would not significantly increase the function