Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Generic Security Service Algorithm for Secret Key Transaction
open-in-new
<p>GSS-TSIG (Generic Security Service Algorithm for Secret Key Transaction) is an extension to the <a href="/facts/TSIG/cBtfHpbN">TSIG</a> DNS <a href="/facts/Authentication_protocol/pcX97lnA">authentication protocol</a> for secure key exchange. It is a GSS-API algorithm which uses <a href="/facts/Kerberos_(protocol)/RMXs3P1w">Kerberos</a> for passing security tokens to provide authentication, integrity and confidentiality. </p><p>GSS-TSIG (RFC 3645) uses a mechanism like <a href="/facts/SPNEGO/Btqy4ffy">SPNEGO</a> with <a href="/facts/Kerberos_(protocol)/RMXs3P1w">Kerberos</a> or <a href="/facts/NTLM/R6H8vAFL">NTLM</a>. In Windows, this implementation is called <i>Secure Dynamic Update</i>. </p><p>GSS-TSIG uses <a href="/facts/TKEY_record/f3ksvxAM">TKEY records</a> for key exchange between the DNS client and server in GSS-TSIG mode. For authentication between the DNS client and <a href="/facts/Active_Directory/VWd9HhjU">Active Directory</a>, the AS-REQ, AS-REP, TGS-REQ, TGS-REP exchanges must take place for granting of ticket and establishing a security context. The security context has a limited lifetime during which dynamic updates to the DNS server can take place. </p>