Subject: [DNSOP] search for reference

From: "A. Schulze" <[email-masked]>
Date: Fri, 30 Dec 2016 12:00:13 +0100

Hello,

I'm searching for a reference (IANA?) that define the DNSSEC hash  
algorithm hmac-sha256
has assigned the number 159
( see http://git.nlnetlabs.nl/ldns/tree/ldns/keys.h#86 )

I only found  
https://www.iana.org/assignments/tsig-algorithm-names/tsig-algorithm-names.xhtml
defining the /name/ but no /number/

Thanks,
Andreas

---

From: Mukund Sivaraman <[email-masked]>
Date: Fri, 30 Dec 2016 16:46:00 +0530

On Fri, Dec 30, 2016 at 12:00:13PM +0100, A. Schulze wrote:
> Hello,
> 
> I'm searching for a reference (IANA?) that define the DNSSEC hash algorithm
> hmac-sha256
> I only found https://www.iana.org/assignments/tsig-algorithm-names/tsig-algorithm-names.xhtml

I suspect that this an ldns implementation detail. DNSSEC doesn't use
HMACs, and TSIG uses DNS names for encoding the algorithm type. This is
likely an ldns implementation enum value for "hmac-sha256".

		Mukund

---

From: Mark Andrews <[email-masked]>
Date: Fri, 30 Dec 2016 22:19:44 +1100

> defining the /name/ but no /number/

It doesn't have a official number.  No hmac algorithms have numbers.
They are also not part of DNSSEC.  159 is just a implementation
assigned number.

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: "A. Schulze" <[email-masked]>
Date: Fri, 30 Dec 2016 12:20:14 +0100

Mukund Sivaraman:

> TSIG uses DNS names for encoding the algorithm type.
I didn't expected that...

Thanks!

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 30 Dec 2016 11:50:33 GMT

> From: "A. Schulze" <[email-masked]>

> I didn't expected that...

Beware that a very popular TSIG implementation is intermittently
confused by upper case algorithm names from a peer despite the fact
that they're encoded like domain names.  If you're writing code that
talks TSIG, I suggest doing what I finally did recently, which is
converting algorithm names to lower case as you put them on or take
them off the wire.

One might constrain local user configuration settings to lower case,
but I'd still ignore case when comparing with what comes off the wire.

Vernon Schryver    [email-masked]

---

From: Dick Franks <[email-masked]>
Date: Sat, 31 Dec 2016 15:42:25 +0000

If you generate keys using the dnssec-keygen that comes with BIND, then
ISC's arbitrary numbers are exposed as follows:

        HMAC-MD5        157        a.k.a.  HMAC-MD5.SIG-ALG.REG.INT
        HMAC-SHA1       161
        HMAC-SHA224   162
        HMAC-SHA256   163
        HMAC-SHA384   164
        HMAC-SHA512   165

Dick Franks
________________________

---

From: Ólafur Guðmundsson <[email-masked]>
Date: Sat, 31 Dec 2016 21:20:57 -0500

Those numbers are not allocated they are just an artifact of bad design
from the 199x's

Olafur