RFC 8945: Secret Key Transaction Authentication for DNS (TSIG)

This document describes a protocol for transaction-level authentication using shared secrets and one-way hashing. It can be used to authenticate dynamic…

Read RFC 8945 on the RFC Editor

Outgoing relationships (25 related RFCs)

Obsoletes, Normative reference — RFC 2845: Secret Key Transaction Authentication for DNS (TSIG)
Obsoletes, Normative reference — RFC 4635: HMAC SHA (Hashed Message Authentication Code, Secure Hash Algorithm) TSIG Algorithm Identifiers
Normative reference — RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
Normative reference — RFC 8174: Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
Normative reference — RFC 1035: Domain names - implementation and specification
Normative reference — RFC 1034: Domain names - concepts and facilities
Normative reference — RFC 3597: Handling of Unknown DNS Resource Record (RR) Types
Informative reference — RFC 8126: Guidelines for Writing an IANA Considerations Section in RFCs
Informative reference — RFC 2104: HMAC: Keyed-Hashing for Message Authentication
Informative reference — RFC 4086: Randomness Requirements for Security
Informative reference — RFC 1321: The MD5 Message-Digest Algorithm
Informative reference — RFC 4033: DNS Security Introduction and Requirements
Informative reference — RFC 4034: Resource Records for the DNS Security Extensions
Informative reference — RFC 4035: Protocol Modifications for the DNS Security Extensions
Informative reference — RFC 6234: US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)
Informative reference — RFC 2136: Dynamic Updates in the Domain Name System (DNS UPDATE)
Informative reference — RFC 6151: Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms
Informative reference — RFC 3174: US Secure Hash Algorithm 1 (SHA1)
Informative reference — RFC 3007: Secure Domain Name System (DNS) Dynamic Update
Informative reference — RFC 4868: Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec
Informative reference — RFC 6895: Domain Name System (DNS) IANA Considerations
Informative reference — RFC 2930: Secret Key Establishment for DNS (TKEY RR)
Informative reference — RFC 7696: Guidelines for Cryptographic Algorithm Agility and Selecting Mandatory-to-Implement Algorithms
Informative reference — RFC 3645: Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS (GSS-TSIG)
Informative reference — RFC 3874: A 224-bit One-way Hash Function: SHA-224

Incoming relationships (6 related RFCs)

Normatively referenced by — RFC 9103: DNS Zone Transfer over TLS
Normatively referenced by — RFC 9715: IP Fragmentation Avoidance in DNS over UDP
Informatively referenced by — RFC 9471: DNS Glue Requirements in Referral Responses
Informatively referenced by — RFC 9664: An EDNS(0) Option to Negotiate Leases on DNS Updates
Informatively referenced by — RFC 9665: Service Registration Protocol for DNS-Based Service Discovery
Informatively referenced by — RFC 9660: The DNS Zone Version (ZONEVERSION) Option