Subject: Please advance draft-ietf-dnsind-tsig-09.txt

From: Robert Elz <[email-masked]>
Date: Mon, 12 Jul 1999 17:58:02 +0200

Thomas, Erik,

The DNSIND working group has completed its deliberations of the
draft

	draft-ietf-dnsind-tsig-09.txt

and requests that be advanced as a proposed standard.

Please arrange for an IETF last call,

Thanks,

kre

---

From: Dennis Glatting <[email-masked]>
Date: Mon, 12 Jul 1999 15:09:54 -0700 (PDT)

> and requests that be advanced as a proposed standard.

Does it make sense for this to be "mandatory to implement" so the
community has a guaranteed base TSIG mechanism? The problem I see is
DNS servers from multiple vendors in a medium to large enterprise with
different TSIG mechanisms resulting in valueless TSIG capability.

-dpg

---

From: Olafur Gudmundsson <[email-masked]>
Date: Tue, 13 Jul 1999 11:23:42 -0400

>different TSIG mechanisms resulting in valueless TSIG capability.

Good catch Dennis, 
Section 2.2 should have a statement in there saying that HMAC-MD5 is 
mandatory to implement. 
It was in there in the early drafts (I think).

	Olafur

----------------------------------------------------
Olafur Gudmundsson 	    		[email-masked]  (work)
443-259-2389 (NEW PHONE NUMBER)	[email-masked]   (private)
301-854-6889  x2389 (if you can not dial 443 area code)

---

From: John Gilmore <[email-masked]>
Date: Wed, 21 Jul 1999 09:16:57 -0700

TSIG should not be mandatory to implement.  It's a poor cryptographic
design providing very minimal security, which has no hope of scaling.
It was intended from the beginning as a stopgap.

	John