Subject: Proposal for TSIG update

From: "Levon Esibov" <[email-masked]>
Date: Mon, 18 Nov 2002 18:34:17 -0800

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

I'd like to ask namedroppers to support a proposal to update TSIG (RFC
2845) as described below:

Currently section 4.2 reads: "The server MUST not generate a signed
response to an unsigned request.". In my opinion this restriction
unnecessarily prevents TKEY mechanism from signing the last response
(i.e. as soon as shared secret key becomes available) in the exchange of
queries/responses that establish shared security key, which would be the
right thing to do for the TKEY protocol.

I propose that TSIG-bis allows TKEY to sign the last response as soon as
shared secret key is established (even if the query was not signed).

Comments?

Thanks,
Levon.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Danny Mayer <[email-masked]>
Date: Tue, 19 Nov 2002 18:44:57 -0500

>shared secret key is established (even if the query was not signed).

Has there been any discussion of this at the IETF meeting? If so, what
feedback did you get? What were the pros and cons?

Danny