Subject: Re: Proposal for TSIG update

From: Danny Mayer <[email-masked]>
Date: Tue, 19 Nov 2002 18:44:57 -0500

At 09:34 PM 11/18/02, Levon Esibov wrote:
>[ post by non-subscriber.  with the massive amount of spam, it is easy to
>   miss and therefore delete mis-posts.  so fix subscription addresses! ]
>
>I'd like to ask namedroppers to support a proposal to update TSIG (RFC
>2845) as described below:
>
>Currently section 4.2 reads: "The server MUST not generate a signed
>response to an unsigned request.". In my opinion this restriction
>unnecessarily prevents TKEY mechanism from signing the last response
>(i.e. as soon as shared secret key becomes available) in the exchange of
>queries/responses that establish shared security key, which would be the
>right thing to do for the TKEY protocol.
>
>I propose that TSIG-bis allows TKEY to sign the last response as soon as
>shared secret key is established (even if the query was not signed).
>
>Comments?

Has there been any discussion of this at the IETF meeting? If so, what
feedback did you get? What were the pros and cons?

Danny

>Thanks,
>Levon.
>
>
>
>--
>to unsubscribe send a message to [email-masked] with
>the word 'unsubscribe' in a single line as the message text body.
>archive: <http://ops.ietf.org/lists/namedroppers/>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>