Home > Articles

Dynamic DNS

  • Print
  • + Share This

TSIG

Using TSIG updates is just a little bit harder than IP authentication and it is a lot more secure. TSIG is short for transaction signature and is a cryptographical signature that the server can check. If the signature is correct, the server knows that the update either came from the authorized client or from someone who has stolen the secret signing key. TSIG uses a mechanism called HMAC-MD5 to authenticate the sender and message content of the updates. HMAC is a mechanism for message authentication to be used in combination with a cryptographic hash routine, MD5 in this case. HMAC is described in RFC 2104; MD5 is described in RFC 1321. HMAC-MD5 is also specified for use in IP-SEC, and in RFC 2403 (a IP-SEC RFC) we find this nice summation:

"HMAC is a secret key authentication algorithm. Data integrity and data origin authentication as provided by HMAC are dependent upon the scope of the distribution of the secret key. If only the source and destination know the HMAC key, this provides both data origin authentication and data integrity for packets sent between the two parties; if the HMAC is correct, this proves that it must have been added by the source."

HMAC-MD5, then, is a secret key, shared secret, or symmetric cryptography. This is different from public key cryptography, which is the kind of cryptography used for email. It is vital that the shared secret remains secret. If anyone manages to steal the key, they can trivially masquerade as you; then they don't even have to spoof their IP address. I'm not a cryptography expert and will not go farther into how this works, but see Handbook of Applied Cryptography or Applied Cryptography for more information on the subject of cryptography. TSIG is currently described in an Internet draft only; it is available at http://www.ietf.org/internet-drafts/draft-ietf-dnsext-tsig-00.txt. TSIG is based on HMAC-MD5.

These are also the properties we want for use with dynamic DNS.

 

  • + Share This
  • 🔖 Save To Your Account

Related Resources

There are currently no related titles. Please check back later.