5 ms·
There is nothing stopping you from doing online signing with DNSSEC. FWIW, DNSSEC is on it's third major iteration, 2/3rds of the TLDs have deployed it, and m
by indolering 11y ago
There is nothing stopping you from doing online signing with DNSSEC. FWIW, DNSSEC is on it's third major iteration, 2/3rds of the TLDs have deployed it, and major DNS service providers are getting into the act.
- marcosdumay 11y agoYou can even avoid domain enumeration by doing online signing with DNSSEC. It's just that people still prefer the offline option.
- yuhong 11y agoAnd the offline signing option adds complexity to the protocol.
- indolering 11y agoSo you are arguing to remove the offline signing capabilities?
- yuhong 11y agoYes.
- indolering 11y agoThat would force companies to either own all of the front-end server farms or store their keys on machines in untrustworthy environments.
- tptacek 11y agoYes: a choice between two very unattractive options. Isn't DNSSEC great?
- indolering 11y agoUh? You can run everything in offline mode, unless you really care about trivial zone enumeration.
- yuhong 11y agoI am not talking about the current DNSSEC, of course.
- Habbie 11y agoI.E. the way SSL/TLS is run today.
- marcosdumay 11y agoOk, my point about people preferring the offline option wasn't criticism. I'd it being the preferred option is strong evidence that the extra complexity is worth it.