Secret Key Transaction Authentication for DNS (TSIG)

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 22
Abstract: This document describes a protocol for transaction-level authentication using shared secrets and one-way hashing. It can be used to authenticate dynamic updates to a DNS zone as coming from an approved client or to authenticate responses as coming from an approved name server. No recommendation is made here for distributing the shared secrets; it is expected that a network administrator will statically configure name servers and clients using some out-of-band mechanism. This document obsoletes RFCs 2845 and 4635.
Publication Date: 2020-11-01
Status Note: Internet Standard
DOI: 10.17487/RFC8945
Link: https://doi.org/10.17487/RFC8945
Author(s): Francis Dupont
Stephen Morris
Paul A. Vixie
Donald E. Eastlake 3rd
Ólafur Guðmundsson
Brian Wellington

Latest version of IETF RFC 8945

Document Versions — IETF RFC 8945

▶ IETF RFC 8945 (2020-11-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

NIST FIPS 180-4 [Active]
IETF RFC 1034 [Active*]
IETF RFC 1035 [Active, Amended*]
IETF RFC 2119 [Active*]
IETF RFC 2845 [Superseded*]
IETF RFC 3597 [Active*]
IETF RFC 4635 [Superseded*]
IETF RFC 8174 [Active*]

Bibliographic Reference(s)

IANA, "DNS RCODEs", <https://www.iana.org/assignments/dns-parameters/>. EXTERNAL
Leurent, G. and T. Peyrin, "SHA-1 is a Shambles", January 2020, <https://eprint.iacr.org/2020/014.pdf>. EXTERNAL
Common Vulnerabilities and Exposures, "CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery", June 2017, <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11104>. EXTERNAL
Common Vulnerabilities and Exposures, "CVE-2017-3142: An error in TSIG authentication can permit unauthorized zone transfers", June 2017, <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3142>. EXTERNAL
Common Vulnerabilities and Exposures, "CVE-2017-3143: An error in TSIG authentication can permit unauthorized dynamic updates", June 2017, <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3143>. EXTERNAL
IANA, "TSIG Algorithm Names", <https://www.iana.org/assignments/tsig-algorithm-names/>. EXTERNAL
IETF RFC 1321 [Active*]
IETF RFC 2104 [Active, Amended*]
IETF RFC 2136 [Active*]
IETF RFC 2930 [Active*]
IETF RFC 3007 [Active*]
IETF RFC 3174 [Active, Amended*]
IETF RFC 3645 [Active*]
IETF RFC 3874 [Active*]
IETF RFC 4033 [Active*]
IETF RFC 4034 [Active*]
IETF RFC 4035 [Active*]
IETF RFC 4086 [Active*]
IETF RFC 4868 [Active*]
IETF RFC 6151 [Active*]
IETF RFC 6234 [Active*]
IETF RFC 6895 [Active*]
IETF RFC 7696 [Active*]
IETF RFC 8126 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC8945.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 8945, Secret Key Transaction Authentication for DNS (TSIG). Available at https://doi.org/10.17487/RFC8945

Snippet:

IETF RFC 8945, Secret Key Transaction Authentication for DNS (TSIG). Available at https://doi.org/10.17487/RFC8945

HTML (ISO 690 compliant)

Preview:

IETF RFC 8945, Secret Key Transaction Authentication for DNS (TSIG). Available at https://doi.org/10.17487/RFC8945

Snippet:

<span class="citation"><cite>IETF RFC 8945</cite>, Secret Key Transaction Authentication for DNS (TSIG). Available at <a href="https://doi.org/10.17487/RFC8945" target="_blank" rel="noopener">https://doi.org/10.17487/RFC8945</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 8945, Secret Key Transaction Authentication for DNS (TSIG)
doi: 10.17487/RFC8945
url: https://doi.org/10.17487/RFC8945

Snippet:

<li>
<cite id="bib-rfc8945">IETF RFC 8945</cite>, Secret Key Transaction Authentication for DNS (TSIG)
<span class="doi">10.17487/RFC8945</span>
</li>

Referenced By

IETF RFC 9103 [Active*]
IETF RFC 9210 [Active*]
IETF RFC 9471 [Active*]