3 ms·
> "There are methods to prevent leaking" isn't the same as "leaking is prevented by default." This is from the zone enumeration section and plain DNS doesn't d
by indolering 11y ago
> "There are methods to prevent leaking" isn't the same as "leaking is prevented by default."
This is from the zone enumeration section and plain DNS doesn't do anything to prevent zone enumeration by default either.
> EdDSA
We are working on standardizing EdDSA, but it takes a long time to get to deployment.
- sarciszewski 11y agoGood, come back when it's standardized. Until then, stamps [REJECTED] on the DNSSEC folder death to 90's crypto
- geofft 11y agoI thought part of successfully killing off '90s crypto was deploying useful, obviously-correct systems without waiting for standards committees to bikeshed them to death (cf. CFRG).
- sarciszewski 11y agoSorry what were you saying? I couldn't hear you over the bitter arguments about endian-ness.
- indolering 11y ago> Until then, stamps [REJECTED] on the DNSSEC folder death to 90's crypto If you read TFA you would see that we are transitioning to P-256. FWIW, ECC crypto is really slow and we will need to transition to post-quantum crypto in another 10 or 15 years.
- sarciszewski 11y agoI did the article. ECC crypto can mean ECDSA which is also flawed 90's crypto. I specifically demanded EdDSA which can more easily be implemented in a high speed and constant time. I'm sorry you're so laser focused on your own writing, but the DNSSEC debate is bigger than you.
- tptacek 11y ago"ECC crypto is really slow"? Please explain what you mean by that.
- indolering 11y agoECC signature verification is slower and big resolvers are complaining about it. Ed25519 is faster than the equivalent P curve but it's still slower than log-based crypto.
- tptacek 11y agoThe alternative in DNSSEC to ECDSA isn't "log based crypto".
- tptacek 11y agoThat's an implausible claim, because even the IRTF CFRG can't standardize EdDSA. At any rate, you can say this about literally any bad cryptosystem. "We're working on standardizing X" is just another way to say "someday maybe we'll have X".