4 ms·

But what do you mean by "online signing" ?

• yuhong 11y ago
  One of the problems is that it exposed DNS zone information, and one of the reason it did that was it was designed to require signing only once and after that the private key didn't have to be used again until the zone info changes.
  • indolering 11y ago
    Are you talking about zone enumeration? That's covered in the article.
    • geofft 11y ago
      Can you provide an NSEC white-lie response to an arbitrary query without an online key? (I'm not sure if this is what was being asked, but I'm curious about the answer to that, either way.)
      • yuhong 11y ago
        Don't think so.
        • indolering 11y ago
          I believe so: http://dankaminsky.com/2011/01/05/djb-ccc/#whitelies http://dankaminsky.com/2011/01/05/djb-ccc/#whitelies (Phreebird is an online signer, but I don't see why an offline signer couldn't generate these proofs.)
          • tptacek 11y ago
            Because you can't predict offline which names you need to obscure with fake NSEC records. If there is any company in the world actually using Phreebird in production, I'd --- for more than one reason --- like to know about it.
            • Habbie 11y ago
              I don't know of any either, but there are plenty running PowerDNS in online 'white lies' signing mode. And then, of course, there is Cloudflare. (And indeed, it cannot be done offline - although doing much narrower NSEC/NSEC3 ranges than 'normal' could be done offline).
      • Habbie 11y ago
        No, not in the narrowest way. You can go 'somewhere in between' at the cost of blowing up your zone size tremendously, but it's not worth it.
  • deleted 11y ago
    [deleted]