RFC 2930 (rfc2930) - Page 2 of 16

Secret Key Establishment for DNS (TKEY RR)

RFC 2930                    The DNS TKEY RR               September 2000


Table of Contents

   1. Introduction...............................................  2
   1.1 Overview of Contents......................................  3
   2. The TKEY Resource Record...................................  4
   2.1 The Name Field............................................  4
   2.2 The TTL Field.............................................  5
   2.3 The Algorithm Field.......................................  5
   2.4 The Inception and Expiration Fields.......................  5
   2.5 The Mode Field............................................  5
   2.6 The Error Field...........................................  6
   2.7 The Key Size and Data Fields..............................  6
   2.8 The Other Size and Data Fields............................  6
   3. General TKEY Considerations................................  7
   4. Exchange via Resolver Query................................  8
   4.1 Query for Diffie-Hellman Exchanged Keying.................  8
   4.2 Query for TKEY Deletion...................................  9
   4.3 Query for GSS-API Establishment........................... 10
   4.4 Query for Server Assigned Keying.......................... 10
   4.5 Query for Resolver Assigned Keying........................ 11
   5. Spontaneous Server Inclusion............................... 12
   5.1 Spontaneous Server Key Deletion........................... 12
   6. Methods of Encryption...................................... 12
   7. IANA Considerations........................................ 13
   8. Security Considerations.................................... 13
   References.................................................... 14
   Author's Address.............................................. 15
   Full Copyright Statement...................................... 16

1. Introduction

   The Domain Name System (DNS) is a hierarchical, distributed, highly
   available database used for bi-directional mapping between domain
   names and addresses, for email routing, and for other information
   [RFC 1034, 1035].  It has been extended to provide for public key
   security and dynamic update [RFC 2535, RFC 2136].  Familiarity with
   these RFCs is assumed.

   [RFC 2845] provides a means of efficiently authenticating DNS
   messages using shared secret keys via the TSIG resource record (RR)
   but provides no mechanism for setting up such keys other than manual
   exchange. This document specifies a TKEY RR that can be used in a
   number of different modes to establish and delete such shared secret
   keys between a DNS resolver and server.







Eastlake                    Standards Track