mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-28 04:58:04 +00:00
Code Issues Releases Wiki Activity
bind/doc/arm/man.isc-hmac-fixup.html

132 lines
4.6 KiB
HTML
Raw Normal View History

4456. [doc] Add DOCTYPE and lang attribute to <html> tags. [RT #42587]
2016-08-26 15:14:04 +10:00
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
<!--
regen master
2017-01-06 01:05:20 +00:00
- Copyright (C) 2000-2017 Internet Systems Consortium, Inc. ("ISC")
regen HEAD
2010-05-19 01:14:14 +00:00
-
regen master
2016-07-21 07:11:01 +00:00
- This Source Code Form is subject to the terms of the Mozilla Public
- License, v. 2.0. If a copy of the MPL was not distributed with this
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
-->
4456. [doc] Add DOCTYPE and lang attribute to <html> tags. [RT #42587]
2016-08-26 15:14:04 +10:00
<html lang="en">
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>isc-hmac-fixup</title>
regen master
2015-10-07 04:11:09 +00:00
<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
[master] upgrade doc toolchain 4237. [doc] Upgraded documentation toolchain to use DocBook 5 and dblatex. [RT #40766]
2015-10-05 21:59:35 -07:00
<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
regen master
2015-01-09 01:05:02 +00:00
<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
<link rel="prev" href="man.genrandom.html" title="genrandom">
[master] upgrade doc toolchain 4237. [doc] Upgraded documentation toolchain to use DocBook 5 and dblatex. [RT #40766]
2015-10-05 21:59:35 -07:00
<link rel="next" href="man.nsec3hash.html" title="nsec3hash">
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
<div class="navheader">
<table width="100%" summary="Navigation header">
<tr><th colspan="3" align="center"><span class="application">isc-hmac-fixup</span></th></tr>
<tr>
<td width="20%" align="left">
<a accesskey="p" href="man.genrandom.html">Prev</a><EFBFBD></td>
<th width="60%" align="center">Manual pages</th>
[master] upgrade doc toolchain 4237. [doc] Upgraded documentation toolchain to use DocBook 5 and dblatex. [RT #40766]
2015-10-05 21:59:35 -07:00
<td width="20%" align="right"><EFBFBD><a accesskey="n" href="man.nsec3hash.html">Next</a>
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
</td>
</tr>
</table>
<hr>
</div>
regen master
2015-10-07 04:11:09 +00:00
<div class="refentry">
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
<a name="man.isc-hmac-fixup"></a><div class="titlepage"></div>
regen master
2016-12-07 01:05:34 +00:00
<div class="refnamediv">
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
<h2>Name</h2>
regen master
2016-12-07 01:05:34 +00:00
<p>
<span class="application">isc-hmac-fixup</span>
&#8212; fixes HMAC keys generated by older versions of BIND
</p>
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
</div>
regen master
2016-12-07 01:05:34 +00:00
<div class="refsynopsisdiv">
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
<h2>Synopsis</h2>
regen master
2016-12-07 01:05:34 +00:00
<div class="cmdsynopsis"><p>
<code class="command">isc-hmac-fixup</code>
{<em class="replaceable"><code>algorithm</code></em>}
{<em class="replaceable"><code>secret</code></em>}
</p></div>
</div>
<div class="refsection">
regen master
2016-08-25 01:04:54 +00:00
<a name="id-1.14.34.7"></a><h2>DESCRIPTION</h2>
regen master
2016-12-07 01:05:34 +00:00
<p>
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
Versions of BIND 9 up to and including BIND 9.6 had a bug causing
HMAC-SHA* TSIG keys which were longer than the digest length of the
hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
longer than 256 bits, etc) to be used incorrectly, generating a
message authentication code that was incompatible with other DNS
implementations.
</p>
regen master
2016-12-07 01:05:34 +00:00
<p>
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
This bug has been fixed in BIND 9.7. However, the fix may
cause incompatibility between older and newer versions of
[master] upgrade doc toolchain 4237. [doc] Upgraded documentation toolchain to use DocBook 5 and dblatex. [RT #40766]
2015-10-05 21:59:35 -07:00
BIND, when using long keys. <span class="command"><strong>isc-hmac-fixup</strong></span>
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
modifies those keys to restore compatibility.
</p>
regen master
2016-12-07 01:05:34 +00:00
<p>
[master] upgrade doc toolchain 4237. [doc] Upgraded documentation toolchain to use DocBook 5 and dblatex. [RT #40766]
2015-10-05 21:59:35 -07:00
To modify a key, run <span class="command"><strong>isc-hmac-fixup</strong></span> and
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
specify the key's algorithm and secret on the command line. If the
secret is longer than the digest length of the algorithm (64 bytes
for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
new secret will be generated consisting of a hash digest of the old
secret. (If the secret did not require conversion, then it will be
printed without modification.)
</p>
regen master
2016-12-07 01:05:34 +00:00
</div>
<div class="refsection">
regen master
2016-08-25 01:04:54 +00:00
<a name="id-1.14.34.8"></a><h2>SECURITY CONSIDERATIONS</h2>
regen master
2016-12-07 01:05:34 +00:00
<p>
[master] upgrade doc toolchain 4237. [doc] Upgraded documentation toolchain to use DocBook 5 and dblatex. [RT #40766]
2015-10-05 21:59:35 -07:00
Secrets that have been converted by <span class="command"><strong>isc-hmac-fixup</strong></span>
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
are shortened, but as this is how the HMAC protocol works in
operation anyway, it does not affect security. RFC 2104 notes,
"Keys longer than [the digest length] are acceptable but the
extra length would not significantly increase the function
strength."
</p>
regen master
2016-12-07 01:05:34 +00:00
</div>
<div class="refsection">
regen master
2016-08-25 01:04:54 +00:00
<a name="id-1.14.34.9"></a><h2>SEE ALSO</h2>
regen master
2016-12-07 01:05:34 +00:00
<p>
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
<em class="citetitle">RFC 2104</em>.
</p>
regen master
2016-12-07 01:05:34 +00:00
</div>
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
</div>
<div class="navfooter">
<hr>
<table width="100%" summary="Navigation footer">
<tr>
<td width="40%" align="left">
<a accesskey="p" href="man.genrandom.html">Prev</a><EFBFBD></td>
regen master
2015-01-09 01:05:02 +00:00
<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
[master] upgrade doc toolchain 4237. [doc] Upgraded documentation toolchain to use DocBook 5 and dblatex. [RT #40766]
2015-10-05 21:59:35 -07:00
<td width="40%" align="right"><EFBFBD><a accesskey="n" href="man.nsec3hash.html">Next</a>
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
</td>
</tr>
<tr>
<td width="40%" align="left" valign="top">
<span class="application">genrandom</span><EFBFBD></td>
<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
[master] upgrade doc toolchain 4237. [doc] Upgraded documentation toolchain to use DocBook 5 and dblatex. [RT #40766]
2015-10-05 21:59:35 -07:00
<td width="40%" align="right" valign="top"><EFBFBD><span class="application">nsec3hash</span>
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
</td>
</tr>
</table>
</div>
regen master
2017-01-10 01:04:52 +00:00
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0-pre-alpha</p>
2834. [bug] HMAC-SHA* keys that were longer than the algorithm digest length were used incorrectly, leading to interoperability problems with other DNS implementations. This has been corrected. (Note: If an oversize key is in use, and compatibility is needed with an older release of BIND, the new tool "isc-hmac-fixup" can convert the key secret to a form that will work with all versions.) [RT #20751]
2010-01-07 21:52:12 +00:00
</body>
</html>
Reference in New Issue Copy Permalink