71–80 of 81 posts
Earlier quoted context omitted.
Are you talking about zone enumeration? That's covered in the article.
Can you provide an NSEC white-lie response to an arbitrary query without an online key? (I'm not sure if this is what was being asked, but I'm curious about the answer to that, either way.)
The authors of this post missed the fact that there's an FAQ linked to the top of the post, where I rebutted all of these objections (and many better ones) 8 months ago. Rather than tediously recapping the same points again, I'll just direct their attention to the link: http://sockpuppet.org/stuff/dnssec-qa.html Dan Kaminsky, speaking at the Black Hat CSO Summit this Tuesday, attempted to advocate DNSSEC to the room.…
I tried to address all the major points in your FAQ and Adam Langley's follow-on blogpost as well, but I will take another crack at it.
The authors of this post missed the fact that there's an FAQ linked to the top of the post, where I rebutted all of these objections (and many better ones) 8 months ago. Rather than tediously recapping the same points again, I'll just direct their attention to the link: http://sockpuppet.org/stuff/dnssec-qa.html Dan Kaminsky, speaking at the Black Hat CSO Summit this Tuesday, attempted to advocate DNSSEC to the room.…
I tried to address all the major points in your FAQ and Adam Langley's follow-on blogpost as well, but I will take another crack at it.
Earlier quoted context omitted.
> Until then, stamps [REJECTED] on the DNSSEC folder death to 90's crypto If you read TFA you would see that we are transitioning to P-256. FWIW, ECC crypto is really slow and we will need to transition to post-quantum crypto in another 10 or 15 years.
"ECC crypto is really slow"? Please explain what you mean by that.
Earlier quoted context omitted.
As covered in TFA, DNSCurve provides encryption between a DNS resolver and the client. It doesn't allow domain owners to sign their records. Dan Kaminsky did a good job taking DNSCurve apart back in 2011: http://dankaminsky.com/2011/01/05/djb-ccc/ "I observe this is essentially a walk of Zooko’s Triangle, and does not represent an effective or credible solution to what we’ve learned is the hardest problem at the inte…
"If you are willing to embrace the pitfalls and advantages of such an approach, you don't need DNSSEC." That was in reference to Zooko's Triangle. You have to choose one of the other two if you are doing decentralized. The obvious choice being that you can't trust the human readable host names.
Earlier quoted context omitted.
That would force companies to either own all of the front-end server farms or store their keys on machines in untrustworthy environments.
Yes: a choice between two very unattractive options. Isn't DNSSEC great?
Earlier quoted context omitted.
We're currently working on providing DNSSEC for our customers. The problem with only signing is that we really don't want all the keys to be physically present on our DNS servers, as many of them are hosted in other companies data centres. Having a central online signing server is bad for availability, as DNS down time is really not acceptable. That basically only leaves offline signing.
So have three online signers.