Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently I'm using 128, is this secure enough?

dnssec-keygen -a hmac-md5 -b 128 -n host

Also I'm not sure if "host" is the correct value for -n arg. I believe that the last argument "" is just for the file name - right?

share|improve this question
up vote 2 down vote accepted

HMAC-XXX is capped at the number of bits. If you are using HMAC-MD5, and choose to use more than 128 bits of real random data (as generated with your example command line) it is wasted. The first thing HMAC will do is, if the key is longer than the hash function's length (MD5 in your case) it is run through the hash first, which will return 128 bits.

If your password was ASCII text, like a typed password, then longer is perhaps useful, but for your uses, 128 is the maximum you'd need.

BIND also supports other HMAC functions: HMAC-SHA1, HMAC-SHA256, and HMAC-512. For SHA1, 160 bits is the maximum useful length, SHA256 and SHA512 is 256 and 512 bits.

Note that for all practical purposes, with HMAC, MD5 is probably sufficient.

I also believe your command line is correct.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.