TSIG

Key takeaways

TSIG belongs to science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect TSIG to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of TSIG from memory before moving on to harder problems.

Reference excerpt

TSIG (transaction signature) is a computer-networking protocol defined in RFC 2845. Primarily it enables the Domain Name System (DNS) to authenticate updates to a DNS database. It is most commonly used to update Dynamic DNS or a secondary/slave DNS server. TSIG uses shared secret keys and one-way hashing to provide a cryptographically secure means of authenticating each endpoint of a connection as being allowed to make or respond to a DNS update. Although queries to DNS may usually be made without authentication, updates to DNS must be authenticated, since they make lasting changes to the structure of the Internet naming system. As the update request may arrive via an insecure channel (the Internet), one must take measures to ensure the authenticity and integrity of the request. The use of a key shared by the client making the update and the DNS server helps to ensure the authenticity and integrity of the update request. A one-way hashing function serves to prevent malicious observers from modifying the update and forwarding on to the destination, thus ensuring integrity of the message from source to destination. A timestamp is included in the TSIG protocol to prevent recorded responses from being reused, which would allow an attacker to breach the security of TSIG. This places a requirement on dynamic DNS servers and TSIG clients to contain an accurate clock. Since DNS servers are connected to a network, the Network Time Protocol can provide an accurate time source. DNS updates, like queries, are normally transported via UDP since it requires lower overhead than TCP. However, DNS servers support both UDP and TCP requests.

Implementation An update, as specified in RFC 2136, is a set of instructions to a DNS server. These include a header, the zone to be updated, the prerequisites that must be satisfied, and the record(s) to be updated. TSIG adds a final record, which includes a timestamp and the hash of the request. It also includes the name of the secret key that was used to sign the request. RFC 2535 has recommendations on the form of the name. The response to a successful TSIG update will also be signed with a TSIG record. Failures are not signed to prevent an attacker from learning anything about the TSIG key using specially crafted update "probes". The nsupdate program can use TSIG to do DNS updates. The TSIG record is in the same format as the other records in the update request. The meaning of the fields is described in RFC 1035.

Alternatives to TSIG Although TSIG is widely deployed, there are several problems with the protocol:

It requires distributing secret keys to each host which must make updates. Although still in common usage, the HMAC-MD5 digest is no longer considered very secure. HMAC-SHA256 is preferred. As a result, a number of alternatives and extensions have been proposed.

RFC 2137 specifies an update method using a public key "SIG" DNS record. A client holding the corresponding private key can sign the update request. This method matches the DNSSEC method for secure queries. However, this method is deprecated by RFC 3007. In 2003, RFC 3645 proposed extending TSIG to allow the Generic Security Service (GSS) method of secure key exchange, eliminating the need for manually distributing keys to all TSIG clients. The method for distributing public keys as a DNS resource record (RR) is specified in RFC 2930, with GSS as one mode of this method. A modified GSS-TSIG - using the Windows Kerberos Server - was implemented by Microsoft Windows Active Directory servers and clients called Secure Dynamic Update. In combination with poorly configured DNS (with no reverse lookup zone) using RFC 1918 addressing, reverse DNS updates using this authentication scheme are forwarded en masse to the root DNS servers and thus increase the traffic to root DNS servers. There is an anycast group which deals with this traffic to take it away from the root DNS servers. RFC 2845 defines TSIG, specifies only one allowed hashing function, the 128-bit HMAC-MD5, which is no longer considered to be highly secure. RFC 4635 was circulated to allow RFC 3174 Secure Hash Algorithm (SHA1) hashing and FIPS PUB 180-2 SHA-2 hashing to replace MD5. The 160-bit and 256-bit digests generated by SHA1 and SHA-2 are more secure than the 128-bit digest generated by MD5. RFC 2930 defines TKEY, a DNS record used to distribute keys automatically from a DNS server to DNS clients. RFC 3645 defines GSS-TSIG, which uses gss-api and TKEY to distribute keys automatically in gss-api mode. The DNSCurve proposal has many similarities to TSIG.

Worked examples

Example 1 — a first encounter with TSIG

Start with the simplest possible case. Write down what TSIG claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to TSIG before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about TSIG ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of TSIG

In research: TSIG appears in science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses TSIG in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: TSIG is common in secondary-school and first-year university syllabi. It links to neighbouring topics Domain Name System, Internet Standards, Internet protocols, so understanding it makes those chapters shorter.
In everyday life: Look for TSIG outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

How to study TSIG in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what TSIG means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain TSIG out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is TSIG in simple terms?

TSIG (transaction signature) is a computer-networking protocol defined in RFC 2845. Primarily it enables the Domain Name System (DNS) to authenticate updates to a DNS database.

Why does TSIG matter?

Because it connects several science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study TSIG?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on TSIG.