News for hackers. Stuff that matters.

A comment on For DNSSEC. Parent comment

Re:For DNSSEC by yuhong on Thursday August 06, 2015 @07:01PM (#10020007)
Don't think so.
[ Parent | on HN ]
Re:For DNSSEC by indolering on Thursday August 06, 2015 @08:03PM (#10020248)
I believe so: http://dankaminsky.com/2011/01/05/djb-ccc/#whitelies

(Phreebird is an online signer, but I don't see why an offline signer couldn't generate these proofs.)

[ Parent | on HN ]
Re:For DNSSEC by tptacek on Sunday August 09, 2015 @09:32PM (#10032251)
Because you can't predict offline which names you need to obscure with fake NSEC records.

If there is any company in the world actually using Phreebird in production, I'd --- for more than one reason --- like to know about it.

[ Parent | on HN ]
Re:For DNSSEC by Habbie on Tuesday August 11, 2015 @01:18PM (#10042742)
I don't know of any either, but there are plenty running PowerDNS in online 'white lies' signing mode. And then, of course, there is Cloudflare.

(And indeed, it cannot be done offline - although doing much narrower NSEC/NSEC3 ranges than 'normal' could be done offline).

[ Parent | on HN ]