Can't we simply send the shared secret key along with AXFR query?

A hacker can easily use sniffed TSIG record to authenticate himself. Then how it's called SECURED zone transfer?

  • The point of a signature is that you sign the data without revealing the secret. An attacker listening on the wire will not be able to learn anything about the secret from observing the data and its signature.
    – vidarlo
    Commented Jan 2, 2023 at 7:58
  • 1
    I mean, the goal is not to prevent anyone from accessing your data, it is to prevent malicious parties from understanding it. A bunch of nonsensical bytes is just that if you don't have the secret that goes with it. So no, obviously always hide the secret, never ever send it.
    – xoxel
    Commented Jan 2, 2023 at 8:51


You must log in to answer this question.

Browse other questions tagged .