Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RFC 8945 5.2.3 Time Check and Error Handling compliance #391

Open
ximon18 opened this issue Sep 15, 2024 · 0 comments
Open

RFC 8945 5.2.3 Time Check and Error Handling compliance #391

ximon18 opened this issue Sep 15, 2024 · 0 comments

Comments

@ximon18
Copy link
Member

ximon18 commented Sep 15, 2024

The TsigMiddlewareSvc implemented by PR #380 does not implement this soft requirement of RFC 8945:

The server SHOULD also cache the most recent Time Signed value in a message generated by a key and SHOULD return BADTIME if a message received later has an earlier Time Signed value.

This could be done by storing the keys in a map with the last time signed value, but a few things are not clear:

  1. The underlying tsig::Key type does not impl PartialEq or Eq nor does the underlying ring::hmac::Key type. How does one compare keys then? By name and algorithm type?
  2. How long should the keys be kept in the map for? Should a Weak<Key> be stored and removed when no longer referenced by any KeyStore for example?
  3. Is it enough to compare keys or should the request also come from the same sender as the last message time signed value being compared against? Are there any other requirements?

Ximon

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant