3 ms·
And the offline signing option adds complexity to the protocol.
by yuhong 11y ago
And the offline signing option adds complexity to the protocol.
- indolering 11y agoSo you are arguing to remove the offline signing capabilities?
- yuhong 11y agoYes.
- indolering 11y agoThat would force companies to either own all of the front-end server farms or store their keys on machines in untrustworthy environments.
- tptacek 11y agoYes: a choice between two very unattractive options. Isn't DNSSEC great?
- indolering 11y agoUh? You can run everything in offline mode, unless you really care about trivial zone enumeration.
- yuhong 11y agoI am not talking about the current DNSSEC, of course.
- Habbie 11y agoI.E. the way SSL/TLS is run today.
- marcosdumay 11y agoOk, my point about people preferring the offline option wasn't criticism. I'd it being the preferred option is strong evidence that the extra complexity is worth it.