dnssec-keygen: a key with algorithm 'HMAC-MD5' cannot be a zone key

13 msg	Managing an Internet outage
2 msg	WPAD / PAC woes

dnssec-keygen: a key with algorithm 'HMAC-MD5' ...
\ blrmaani (9 May 2008)
. \ Chris Buxton (9 May 2008)
. \ Mark Andrews (10 May 2008)
. \ blrmaani (11 May 2008)
. \ blrmaani (11 May 2008)

4 msg	Resolution Check
3 msg	BIND can't resolve with unreachable second NS
10 msg	special features
2 msg	Modifying BIND to provide requesting IP address...
3 msg	Setting up my MX's records to redirect mail fro...
9 msg	Multiple SOA records?
6 msg	Bind and OpenLDAP
3 msg	bind dlz : using only Mysql
8 msg	Suggestions for coping with this issue
7 msg	Questions about Bind and AD dns integration
14 msg	Overriding MX records to internal gateways
3 msg	Bind + DKIM (ran out of space)
2 msg	time set to UTC
1 msg	Split horizon with forwarding
8 msg	Are failures cached?
2 msg	catch-all
2 msg	Problems Configuring Bind on Windows Server 2003

Subject:	dnssec-keygen: a key with algorithm 'HMAC-MD5' cannot be a zone key
Group:	Bind-users
From:	blrmaani
Date:	9 May 2008

I used to successfully generate keys when I have BIND 9.2 installed on
my host using the following
commandline

# dnssec-keygen -a HMAC-MD5 -b 128 -n ZONE mykey-otherkey

I upgraded my host to with BIND 9.3 and used the same command line
above to get the following
error:

# dnssec-keygen -a HMAC-MD5 -b 128 -n ZONE mykey-otherkey

dnssec-keygen: a key with algorithm 'HMAC-MD5' cannot be a zone key

What exactly changed? What is the alternative? If I use HOST instead
of ZONE what impact will it
have on the generated keys?

I can't downgrade to BIND 9.2 just to make the above work. Also I
can't have BIND 9.2 and BIND 9.3 both
on my host.

All my script may require change. But please let me know the side
effect?

thanks
Blr