Regarding HMAC-SHA256 and RSASHA512 key generation algorithm in dnssec-keygen

2014-03-03 Thread Gaurav Kansal
Dear Team, I am using RSASHA1 key generation algorithm for generating the KSK and ZSK. Today, I tried to generate the algorithm using RSASHA512 and HMAC-SHA256 algorithm. Key generation through RSASHA512 algorithm run successfully but while generating the keys through HMAC-SHA512

Re: Regarding HMAC-SHA256 and RSASHA512 key generation algorithm in dnssec-keygen

2014-03-03 Thread Tony Finch
Gaurav Kansal gaurav.kan...@nic.in wrote: I have doubt in this only. What's the difference between Zone or Host ?? Zone keys are used for DNSSEC signing zones. Host keys are used for TSIG transaction authentication, for securing zone transfers or dynamic updates. I also want to know which

Re: About the conflict between named and pdnsd.

2014-03-03 Thread Matus UHLAR - fantomas
On 03.03.14 13:29, Hongyi Zhao wrote: I use debian wheezy. In order to solve the dns pollution issue for my case. I install the pdnsd (see here for detail: http://members.home.nl/p.a.rombouts/pdnsd/)on my system. dns pollution issue? At the same time, I also have the bind9 installed by

Re: which Name sever is selected?

2014-03-03 Thread Ben Croswell
By decaying I mean they take some percent of time off of the rtt of the name servers that aren't used when there is a successful query to the fastest. Eventually the slower servers will be faster than the fastest and get queried. That query will set the rtt again for that server and will go back

Re: which Name sever is selected?

2014-03-03 Thread Tony Finch
houguanghua houguang...@hotmail.com wrote: What's the meaning of bind decaying? Where can I find the detailed description? Thanks! There's a summary of the SRTT algorithm in http://securityintelligence.com/subverting-binds-srtt-algorithm-derandomizing-ns-selection/ Tony. --

Re: disabling stateful firewalls for DNS traffic

2014-03-03 Thread Lawrence K. Chen, P.Eng.
This is March, right? I probably should've tried this on one DNS server, instead of all of them. I removed state tracking on outbound to port 53 trafficand nothing could be resolved. And, couldn't fix without manual intervention, as cfagent (cfengine) couldn't resolve its policy server