6 ms·
Personally I think a new DNSSEC2 based on for example online signing might be a good idea.
by yuhong 11y ago
Personally I think a new DNSSEC2 based on for example online signing might be a good idea.
- indolering 11y agoThere is nothing stopping you from doing online signing with DNSSEC. FWIW, DNSSEC is on it's third major iteration, 2/3rds of the TLDs have deployed it, and major DNS service providers are getting into the act.
- marcosdumay 11y agoYou can even avoid domain enumeration by doing online signing with DNSSEC. It's just that people still prefer the offline option.
- yuhong 11y agoAnd the offline signing option adds complexity to the protocol.
- indolering 11y agoSo you are arguing to remove the offline signing capabilities?
- yuhong 11y agoYes.
- indolering 11y agoThat would force companies to either own all of the front-end server farms or store their keys on machines in untrustworthy environments.
- tptacek 11y agoYes: a choice between two very unattractive options. Isn't DNSSEC great?
- indolering 11y agoUh? You can run everything in offline mode, unless you really care about trivial zone enumeration.
- yuhong 11y agoI am not talking about the current DNSSEC, of course.
- Habbie 11y agoI.E. the way SSL/TLS is run today.
- marcosdumay 11y agoOk, my point about people preferring the offline option wasn't criticism. I'd it being the preferred option is strong evidence that the extra complexity is worth it.
- StuntPope 11y agoWhat do you mean?
- yuhong 11y agoDNSSEC has several problems some of which is in the design, as tptacek likes to mention.
- StuntPope 11y agoBut what do you mean by "online signing" ?
- yuhong 11y agoOne of the problems is that it exposed DNS zone information, and one of the reason it did that was it was designed to require signing only once and after that the private key didn't have to be used again until the zone info changes.
- indolering 11y agoAre you talking about zone enumeration? That's covered in the article.
- geofft 11y agoCan you provide an NSEC white-lie response to an arbitrary query without an online key? (I'm not sure if this is what was being asked, but I'm curious about the answer to that, either way.)
- yuhong 11y agoDon't think so.
- indolering 11y ago