"Peter J. Philipp" <[email protected]> writes: > On Mon, Feb 27, 2017 at 10:26:48AM +0100, Peter J. Philipp wrote: >> I had a patch somewhere for TSIG as well somewhere, give me some time to >> find it. TSIG can secure the channel as well, but my implementation wasn't >> all that pretty. > > Here is the patch, it would need fixing up, and it only would work with BIND > nameservers currently :-(. > > http://marc.info/?l=openbsd-tech&m=145656997013119&w=2
Interesting. I can't speak for others but I don't think that TSIG is a good solution. Shared secrets don't buy us much, especially if we have to store them in /etc/resolv.conf. -- jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF DDCC 0DFA 74AE 1524 E7EE
