Subject: Last Call: Secret Key Transaction Signatures for DNS (TSIG) to Proposed Standard

From: The IESG <[email-masked]>
Date: Thu, 14 Oct 1999 12:35:52 -0400

The IESG has received a request from the DNS IXFR, Notification, and
Dynamic Update Working Group to consider Secret Key Transaction
Signatures for DNS (TSIG) <draft-ietf-dnsind-tsig-11.txt> as a Proposed
Standard.

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action.  Please send any comments to the
[email-masked] or [email-masked] mailing lists by October 28, 1999.

Files can be obtained via
http://www.ietf.org/internet-drafts/draft-ietf-dnsind-tsig-11.txt

---

From: Edward Lewis <[email-masked]>
Date: Tue, 19 Oct 1999 21:45:30 -0400

>Signatures for DNS (TSIG) <draft-ietf-dnsind-tsig-11.txt> as a Proposed

Upon hearing of an objection to the name (secret key ... signatures) I
would suggest the title of the document be "Secret Key Transaction Security
for DNS," keeping TSIG as the symbol for historic reasons.

Sec. 2.3 - Time Signed is defined as seconds since epoch (my words).  This
should be "seconds since... modulo 2^48", i.e., "circular time."

Sec. 3.1 - "Appending a transaction...is not allowed...truncated response;
a TCP connection must (sic) be used..." seems to imply that TSIG can not be
used over UDP.  This is not the case, so this sentence should be worded to
be clearer.

BTW - must and should are inconsistently capitalized throughout the document.

Sec. 3 & 4 (various locations) - "should be logged."  This is missing in
4.5.2.  In general, logging is just one way of reporting this, I'd prefer
"should be reported, e.g., in a log and/or MIB entry."  Since this is
getting wordy, I would use the term "reported" and then add a paragraph
defining what reported means.  Overall, not a strong objection on my part
to what is there.

Sec. 3.4.2 - seems to imply that part of the TSIG RR is covered by the
digest.  ("The RR RDLEN ... not included in the hash" seems to imply that
the other parts of the TSIG are included.  Perhaps I am misreading the ":"
at the end of section 3.4.  (I suppose sections 3.4.1, 3.4.2, and 3.4.3 are
concatenated for digest.)

There are a few other spelling and wording comments that are best
communicated to the authors.  (E.g., you can't "prevent" an attack.)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

"Trying is the first step to failure." - Homer Simpson
"No! Try not. Do... or do not. There is no try." - Yoda

Opinions expressed are property of my evil twin, not my employer.