Subject: Re: Protocol Action: GSS Algorithm for TSIG (GSS-TSIG) to Proposed Standard

From: [email-masked]
Date: Mon, 8 Jul 2002 19:34:41 GMT

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

Erik and Randy,

We have <draft-ietf-dnsext-gss-tsig-05.txt> ready to go.  Should we be
waiting for an updated version of this document?

Thank you.

RFC Editor

> From [email-masked]  Fri Apr  5 10:09:55 2002
> Date: Fri, 05 Apr 2002 13:10:07 -0500
> From: [email-masked] (Randy Hall)
> X-Mailer: Mozilla 4.72 [en] (Windows NT 5.0; U)
> X-Accept-Language: en
> MIME-Version: 1.0
> To: Erik Nordmark <[email-masked]>
> CC: Bill Manning <[email-masked]>, Danny Mayer <[email-masked]>,
>    [email-masked], [email-masked], [email-masked],
>    [email-masked]
> Subject: Re: Protocol Action: GSS Algorithm for TSIG (GSS-TSIG) to  Proposed  
>  Standard
> Content-Transfer-Encoding: 7bit
> X-AntiVirus: scanned by AMaViS 0.2.1
> 
> Erik Nordmark wrote:
> 
> > > There were (IMO) bugs in the TKEY, TSIG, and other protocols
> > > that needed fixing, and some changes (IMO) were needed (and
> > > made) to the protocol, but there were no IP issues relating
> > > these issues.
> 
> > Where these bugs in the RFCs or bugs in an implementation of 
> > those RFCs?
> 
> Implementation.
> 
> Cheers
> Randy
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Kevin Dunlap <[email-masked]>
Date: Tue, 09 Jul 2002 21:37:03 +0000

I have found something in GSS Algorithm for TSIG (GSS-TSIG)
draft-ietf-dnsext-gss-tsig-05.txt, that is in conflict with 
RFC 2845 - Secret Key Transaction Authentication for DNS (TSIG).

In draft-ietf-dnsext-gss-tsig-05.txt, Section 3.1.3.1:
Second Paragraph:

    Confirmation is in the form of a query response with RCODE=NOERROR
    and with the last client supplied TKEY record in the answer section of the
    query. The Response MUST be signed with a TSIG record.......

In the TSIG RFC,  RFC 2845, section 4.2 says:

       When a server has generated a response to a signed request, it signs
       the response using the same algorithm and key.  The server MUST not
       generate a signed response to an unsigned request.

I think the fact that the GSS-TSIG TKEY exchange contains a TSIG on a
response when the request did not contain one violates the TSIG RFC.

I find this problem on April 19.  At that point I notified two of the 
Authors of GSS-TSIG and the DNSEXT WG Co-chairs. 
I now realize, I forgot to post somthing to namedroppers.

-Kevin

-------------------
Your message dated: Mon, 08 Jul 2002 19:34:41 GMT