News for hackers. Stuff that matters.

A comment on For DNSSEC. Parent comment

Re:For DNSSEC by indolering on Thursday August 06, 2015 @04:40PM (#10019294)
Are you talking about zone enumeration? That's covered in the article.
[ Parent | on HN ]
Re:For DNSSEC by geofft on Thursday August 06, 2015 @06:59PM (#10019995)
Can you provide an NSEC white-lie response to an arbitrary query without an online key?

(I'm not sure if this is what was being asked, but I'm curious about the answer to that, either way.)

[ Parent | on HN ]
Re:For DNSSEC by Habbie on Tuesday August 11, 2015 @01:24PM (#10042797)
No, not in the narrowest way. You can go 'somewhere in between' at the cost of blowing up your zone size tremendously, but it's not worth it.
[ Parent | on HN ]
Re:For DNSSEC by yuhong on Thursday August 06, 2015 @07:01PM (#10020007)
Don't think so.
[ Parent | on HN ]
Re:For DNSSEC by indolering on Thursday August 06, 2015 @08:03PM (#10020248)
I believe so: http://dankaminsky.com/2011/01/05/djb-ccc/#whitelies

(Phreebird is an online signer, but I don't see why an offline signer couldn't generate these proofs.)

[ Parent | on HN ]
Re:For DNSSEC by tptacek on Sunday August 09, 2015 @09:32PM (#10032251)
Because you can't predict offline which names you need to obscure with fake NSEC records.

If there is any company in the world actually using Phreebird in production, I'd --- for more than one reason --- like to know about it.

[ Parent | on HN ]
Re:For DNSSEC by Habbie on Tuesday August 11, 2015 @01:18PM (#10042742)
I don't know of any either, but there are plenty running PowerDNS in online 'white lies' signing mode. And then, of course, there is Cloudflare.

(And indeed, it cannot be done offline - although doing much narrower NSEC/NSEC3 ranges than 'normal' could be done offline).

[ Parent | on HN ]