<html><body><span style="font-family:Verdana; color:#000000; font-size:10pt;"><div>I'm using HMAC-MD5<br></div><div><br></div><div>Michael Sheldon<br>Dev-DNS Services<br>GoDaddy.com</div><div><br><br></div>
<blockquote id="replyBlockquote" webmail="1" style="border-left: 2px solid blue; margin-left: 8px; padding-left: 8px; font-size: 10pt; color: black; font-family: verdana;">
<div id="wmQuoteWrapper">
-------- Original Message --------<br>
Subject: Re: [ldns-users] TSIG trouble<br>
From: Matthijs Mekking <matthijs@NLnetLabs.nl><br>
Date: Mon, May 10, 2010 6:43 am<br>
To: Michael Sheldon <msheldon@godaddy.com><br>
Cc: ldns-users@open.nlnetlabs.nl<br>
<br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
I have ran into a TSIG incompatibility issue between BIND9 and LDNS.<br>
There was a bug in BIND9 regarding the HMAC-SHA functions, it was fixed<br>
in 9.7.0:<br>
<br>
2834. [bug] HMAC-SHA* keys that were longer than the algorithm<br>
digest length were used incorrectly, leading to<br>
interoperability problems with other DNS<br>
implementations. This has been corrected.<br>
(Note: If an oversize key is in use, and<br>
compatibility is needed with an older release of<br>
BIND, the new tool "isc-hmac-fixup" can convert<br>
the key secret to a form that will work with all<br>
versions.) [RT #20751]<br>
<br>
If you are using SHA, this could very well be the cause.<br>
<br>
<br>
Best regards,<br>
<br>
Matthijs Mekking<br>
NLnet Labs<br>
<br>
<br>
<br>
Michael Sheldon wrote:<br>
> I'm writing a server that uses TSIG, and having some issues with DIG<br>
> against it.<br>
> <br>
> I get the key fine, and validate it without trouble. I then sign the<br>
> result and return it.<br>
> <br>
> drill is happy with it all the way around, no issues.<br>
> The same query with the same key using dig returns the results, but also<br>
> includes:<br>
> ;; WARNING -- Some TSIG could not be validated<br>
> <br>
> Any idea on what I might be looking for?<br>
> <br>
> Using the same TSIG key in NSD works fine with both dig and drill<br>
> <br>
> Michael Sheldon<br>
> <br>
> <br>
> ------------------------------------------------------------------------<br>
> <br>
> _______________________________________________<br>
> ldns-users mailing list<br>
> ldns-users@open.nlnetlabs.nl<br>
> <a target="_blank" href="http://open.nlnetlabs.nl/mailman/listinfo/ldns-users">http://open.nlnetlabs.nl/mailman/listinfo/ldns-users</a><br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.9 (GNU/Linux)<br>
Comment: Using GnuPG with Mozilla - <a target="_blank" href="http://enigmail.mozdev.org">http://enigmail.mozdev.org</a><br>
<br>
iQEcBAEBAgAGBQJL6A2bAAoJEA8yVCPsQCW5GBMH/RYS97SzvnQe+WRsTdQaf924<br>
irZwz+8R/lLOCtIo+IPw3qrsJg2Ty62x6ePX3xNpBQt0eV/Vu4Yz4VR+ct+KAQ4i<br>
ZcFDVAGd752tFgrOqTS1USp4i1UhY98ol6NQtxeJBFziHUyDKF4Pk18898KuddeT<br>
W1h5nO72Oct6S2UtStTV1xJGtGe+HK2XRFTYwGucw3FVc3GsgU4jX1fjqsiP5J+E<br>
FtsT2JrNwsv7wfEJ9cCUK2EviVc6I2DoN7MCa9s8edckZYsAX2P86MWq7HiVQjZE<br>
WrHJ3s8e8O3FZr0ZdvpCWAmeKG1Ul8NBjyw5pHS5qh4KUydQfGr4/s/Uy7RZnLU=<br>
=hIbi<br>
-----END PGP SIGNATURE-----<br>
</div>
</blockquote></span></body></html>