RE: 'tsig-keygen' vs 'dnssec-keygen' - keysize

> -Original Message- > From: Evan Hunt [mailto:e...@isc.org] > Sent: Thursday, 6 September 2018 4:35 PM > To: Browne, Stuart > Cc: Mark Andrews; bind-users@lists.isc.org > Subject: Re: 'tsig-keygen' vs 'dnssec-keygen' - keysize > > > Is there no cryptographic difference between the sho

Re: 'tsig-keygen' vs 'dnssec-keygen' - keysize

On Thu, Sep 06, 2018 at 04:28:23AM +, Browne, Stuart via bind-users wrote: > Ok, then here goes me in my not-really-understanding HMAC properly. > > When using 'dnssec-keygen -a hmac-md5 -b 512 -n HOST some-name' (512 > being the max keysize lited in 'dnssec-keygen -h'), we end up with an 88 >

RE: 'tsig-keygen' vs 'dnssec-keygen' - keysize

Ok, then here goes me in my not-really-understanding HMAC properly. When using 'dnssec-keygen -a hmac-md5 -b 512 -n HOST some-name' (512 being the max keysize lited in 'dnssec-keygen -h'), we end up with an 88 byte string of secret data. When using 'tsig-keygen -a hmac-md5 some-name', we end up