man.isc-hmac-fixup.html revision 8dcec3cf256105c620d02d5c84c9ccbfe495ca8d
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
67a04a3de424d4431f7f41e3a8d025007d2faea4Mark Andrews - Copyright (C) 2000-2016 Internet Systems Consortium, Inc. ("ISC")
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews - This Source Code Form is subject to the terms of the Mozilla Public
75216e007570b8ea36b3ac9cca096bf70c0ca6f6Mark Andrews - License, v. 2.0. If a copy of the MPL was not distributed with this
75216e007570b8ea36b3ac9cca096bf70c0ca6f6Mark Andrews - file, You can obtain one at http://mozilla.org/MPL/2.0/.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
75216e007570b8ea36b3ac9cca096bf70c0ca6f6Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
75216e007570b8ea36b3ac9cca096bf70c0ca6f6Mark Andrews<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<link rel="prev" href="man.genrandom.html" title="genrandom">
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<link rel="next" href="man.nsec3hash.html" title="nsec3hash">
af5073d03288a53b646ec3b807ac25ced64d7879Mark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
75216e007570b8ea36b3ac9cca096bf70c0ca6f6Mark Andrews<table width="100%" summary="Navigation header">
af5073d03288a53b646ec3b807ac25ced64d7879Mark Andrews<tr><th colspan="3" align="center"><span class="application">isc-hmac-fixup</span></th></tr>
75216e007570b8ea36b3ac9cca096bf70c0ca6f6Mark Andrews<a accesskey="p" href="man.genrandom.html">Prev</a>�</td>
75216e007570b8ea36b3ac9cca096bf70c0ca6f6Mark Andrews<th width="60%" align="center">Manual pages</th>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson<td width="20%" align="right">�<a accesskey="n" href="man.nsec3hash.html">Next</a>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<a name="man.isc-hmac-fixup"></a><div class="titlepage"></div>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <span class="application">isc-hmac-fixup</span>
75216e007570b8ea36b3ac9cca096bf70c0ca6f6Mark Andrews — fixes HMAC keys generated by older versions of BIND
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews {<em class="replaceable"><code>algorithm</code></em>}
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews {<em class="replaceable"><code>secret</code></em>}
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Versions of BIND 9 up to and including BIND 9.6 had a bug causing
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews HMAC-SHA* TSIG keys which were longer than the digest length of the
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
75216e007570b8ea36b3ac9cca096bf70c0ca6f6Mark Andrews longer than 256 bits, etc) to be used incorrectly, generating a
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews message authentication code that was incompatible with other DNS
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews implementations.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson This bug has been fixed in BIND 9.7. However, the fix may
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson cause incompatibility between older and newer versions of
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson BIND, when using long keys. <span class="command"><strong>isc-hmac-fixup</strong></span>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson modifies those keys to restore compatibility.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson To modify a key, run <span class="command"><strong>isc-hmac-fixup</strong></span> and
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson specify the key's algorithm and secret on the command line. If the
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson secret is longer than the digest length of the algorithm (64 bytes
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson new secret will be generated consisting of a hash digest of the old
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson secret. (If the secret did not require conversion, then it will be
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson printed without modification.)
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<a name="id-1.14.34.8"></a><h2>SECURITY CONSIDERATIONS</h2>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Secrets that have been converted by <span class="command"><strong>isc-hmac-fixup</strong></span>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews are shortened, but as this is how the HMAC protocol works in
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews operation anyway, it does not affect security. RFC 2104 notes,
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews "Keys longer than [the digest length] are acceptable but the
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews extra length would not significantly increase the function
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<table width="100%" summary="Navigation footer">
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<a accesskey="p" href="man.genrandom.html">Prev</a>�</td>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<td width="40%" align="right">�<a accesskey="n" href="man.nsec3hash.html">Next</a>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<span class="application">genrandom</span>�</td>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<td width="40%" align="right" valign="top">�<span class="application">nsec3hash</span>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.1rc2</p>