GSS-TSIG (Generic Security Service Algorithm for Secret Key Transaction) is an extension to the
TSIG TSIG (transaction signature) is a computer-networking protocol defined
in RFC 2845. Primarily it enables the Domain Name System (DNS) to authenticate updates to a DNS database. It is most commonly used to update Dynamic DNS or a secondary/slave D ...
DNS
authentication protocol
An authentication protocol is a type of computer communications protocol or cryptographic protocol specifically designed for transfer of authentication data between two entities. It allows the receiving entity to authenticate the connecting entity ...
for secure key exchange. It is a GSS-API algorithm which uses
Kerberos for passing security tokens to provide authentication, integrity and confidentiality.
GSS-TSIG (RFC 3645) uses a mechanism like
SPNEGO
Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO), often pronounced "spenay-go", is a GSSAPI "pseudo mechanism" used by client-server software to negotiate the choice of security technology. SPNEGO is used when a client application wants ...
with
Kerberos or
NTLM
In a Windows network, NT (New Technology) LAN Manager (NTLM) is a suite of Microsoft security protocols intended to provide authentication, integrity, and confidentiality to users. NTLM is the successor to the authentication protocol in Microsoft L ...
. In Windows, this implementation is called ''Secure Dynamic Update''.
Secure Dynamic Update: Windows 2000 DNS - MSDN
/ref>
GSS-TSIG uses TKEY records for key exchange between the DNS client and server in GSS-TSIG mode. For authentication between the DNS client and Active Directory
Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. Initially, Active Directory was used only for centralize ...
, the AS-REQ, AS-REP, TGS-REQ, TGS-REP exchanges must take place for granting of ticket and establishing a security context. The security context has a limited lifetime during which dynamic updates to the DNS server can take place.
References
{{reflist
Cryptographic protocols