Subject: Re: doc/draft/draft-ietf-dnsext-tsig-sha-01.txt

From: Mark Andrews <[email-masked]>
Date: Tue, 01 Mar 2005 16:08:36 +1100

HMAC Truncation.

	Looking at this there is nothing to say whether a reply
	has to use the same number of bits as the query?

	i.e.
		Can a server respond to a truncated HMAC-SHA1 w/
	a full HMAC-SHA1?

	If you are rejecting a TSIG because the number of bits is
	too small what is the RCODE in the TSIG?  BADAUTH+????

	Is the server supposed to auto adjust to the client within
	limits (max(80 bits, half digest bits)) or is the server
	supposed to specify a absolute number of expected bits or
	a minimum number of expected bits.

	How does a server, if it rejecting because of too few bits,
	signal the minimum number of bits it will accept for this
	key.

	Is truncation just too much of a complication?
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE:	+61 2 9871 4742		         INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>