Hacker News Reader

Comment by yuhong | Hacker News Reader

DNSSEC however has its own problems. I have been thinking of a DNSSEC2 proposal for a while now that for example would use online signing only.

View on HN

Having no support for offline signing in and of itself isn't a selling point. What else does your approach have to offer?

It is a selling point in that it simplifies the protocol, making it easier to implement. Obviously it would not be the only difference.

> It is a selling point in that it simplifies the protocol, making it easier to implement.

In the current protocol the only difference between offline and online signing is in how authoritative servers are implemented. There the differences aren't all that significant (relative to building an authoritative server as a whole) -- the same data needs signing, etc -- so please explain how your protocol makes implementation simpler.

> Obviously it would not be the only difference.

Can you please expand on that? You've said you've been thinking of a DNSSEC2 proposal for a while so you must have more to say.

I forgot to mention that one of the known problems of DNSSEC is the DNS zone information disclosure problem. Online signing would allow the problem to be eliminated and reduce complexity by the protocol no longer having to be designed for enumerating DNS records. Of course, DNSSEC2 would probably only allow ECC signing too (I suggest both NIST curves and Curve25519 as options).

Online signing and white lies are already in DNSSEC. What you've described so far doesn't seem to be different to the status quo. Even deprecation of older cryptographic signatures is being worked through at the moment.

I know about this. That is why I mentioned the complexity that comes from the original protocol design being designed for offline signing.

You have said you have been thinking of a DNSSEC2 proposal for a while, that your protocol differs in multiple ways and that it is easier to implement. Given this you should be able to concretely articulate how your protocol differs and where its advantages are gained. Thus far you have not shown the ability to do this.

It is just a bunch of ideas at this point and not even a complete list of them.

The DNS root servers need offline signing. Many servers are in untrusted areas (think intervention from local government).

I think DNSSEC already deals with this by offline signing another key that actually signs the DNS root zone.

Reply on news.ycombinator.com