On 19/11/2018 13:45, Mukund Sivaraman wrote:
Soon after this TSIG authentication bypass attack was reported, during a
review of the BIND TSIG implementation by Ray Bellis and me, we found a
couple of other issues. One of them is not a real-world issue (to do
with under-specification of what to do with full MAC length having
non-integral number of octets - there are no such common HMACs
currently), and another that I'm not able to remember that had to do
with an off-by-1 (or something similar) on the fudge and time signed
fields. Do you have any recollection of it Ray?
I vaguely recall the discussion but not the detail of it.
ISTR it was something to do with using a <= comparison rather than <, or
vice versa.
Ray
_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop
