HMAC SHA (Hashed Message Authentication Code, Secure Hash Algorithm) TSIG Algorithm Identifiers
obsoleted by
- rfc-8945 — Secret Key Transaction Authentication for DNS (TSIG)
updates
- rfc-2845 — Secret Key Transaction Authentication for DNS (TSIG)
Extracted elements (18)
SHA-1 (160-bit) and additional SHA family algorithms (224, 256, 384, 512 bits) are preferred over MD5 (128-bit) because increasingly successful cryptanalytic attacks have been made on shorter hashes, motivating migration to stronger algorithms.
TSIG truncation to 96 bits is modeled on existing IETF practice in IPsec and TLS, where HMAC SHA-1 truncated to 96 bits is an established option, making it a natural choice for TSIG as well.
Receipt of an unknown, unimplemented, or disabled TSIG algorithm identifier typically results in a BADKEY error. Local policies MAY require rejection of TSIGs even for mandatory algorithms.
Use of TSIG presumes prior agreement between the resolver and server on the algorithm and key to be used; key agreement can be via the TKEY mechanism (RFC 2930) or another mutually agreeable method.
A reply SHOULD be sent with a MAC at least as long as that in the corresponding request, unless the request specified a MAC length longer than the HMAC output.
If the MAC size field in a TSIG RR is greater than the HMAC output length, this case MUST NOT be generated and, if received, MUST cause the packet to be dropped and RCODE 1 (FORMERR) to be returned.
If the MAC size field is less than the larger of 10 octets and half the length of the hash function in use (except for permitted zero-MAC TSIG error messages), this case MUST NOT be generated and MUST cause the packet to be dropped with RCODE 1 (FORMERR).
Implementations permitting multiple acceptable algorithms and/or truncations SHOULD permit this list to be ordered by presumed strength and SHOULD allow different truncations for the same algorithm to be treated as separate entities.
Implementations that support TSIG MUST also implement HMAC SHA1 and HMAC SHA256. The HMAC-MD5.SIG-ALG.REG.INT algorithm remains mandatory, while gss-tsig, hmac-sha224, hmac-sha384, and hmac-sha512 are optional.
SHA-1 truncated to 96 bits (12 octets) SHOULD be implemented as a truncation option for TSIG.
When a local policy permits acceptance of a TSIG with a particular algorithm and non-zero truncation, it SHOULD also permit that algorithm with lesser truncation (longer MAC) up to the full HMAC output.
When a TSIG is received with truncation permitted under Section 3 but the MAC is too short for the local policy, an RCODE of 22 (BADTRUNC) MUST be returned.
The TSIG RR MAC size field controls truncation behavior: equal to HMAC output length means full MAC is present; less than HMAC output length (but above minimum) indicates truncation where only the initial octets are retained and trailing octets discarded.
TSIG algorithm identifiers defined: HMAC-MD5.SIG-ALG.REG.INT (mandatory), hmac-sha1 (mandatory), hmac-sha256 (mandatory), gss-tsig (optional), hmac-sha224 (optional), hmac-sha384 (optional), hmac-sha512 (optional). These are domain name syntax identifiers carried in the TSIG RR.
This document registers new TSIG algorithm identifiers (hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, hmac-sha512) with IANA and allocates RCODE 22 (BADTRUNC) in the DNS RCODE registry defined by RFC 2845.
Longer MAC values are believed to provide stronger authentication. While mild truncation may reduce information available to an attacker, excessive truncation weakens authentication by reducing the bits an attacker must overcome by brute force, as described in RFC 2104.
Significant cryptanalytic progress against MD4-derived hash functions prompted making SHA-1 and SHA-256 mandatory rather than optional, despite no current results affecting HMAC specifically.
The TSIG RR 'MAC size' field specifies the length in octets of the MAC field. Truncation is signaled by a MAC size less than the full HMAC output length. The minimum allowable MAC size is the larger of 10 octets and half the hash function output length.