Re:ICANN urges adopting DNSSEC now
by tptacek on Sunday April 21, 2019 @03:48PM
(#19714139)
Essentially all non-toy real-world deployments of DNSSEC (perhaps outside of the DNSSEC root and TLD infrastructure itself) requires online signers, not just for basic operational reasons but because online signing is how defense against zone dumping (NSEC+"whitelies") works. So, yes, there are definitely servers that do online signing.
But then you're left wondering: why would we deploy a protocol that took profound tradeoffs to facilitate offline signing, when it turns out most of the real-world use cases were going to be online? If the protocol had been designed for online signers in the first place, it would be cleaner and more powerful in a bunch of different ways.
Instead, DNSSEC advocates propose that --- despite the fact that the industry has essentially not meaningfully deployed the protocol yet, after 25 years of standardization effort --- we just say "fuck it" and deploy this 90s protocol anyways. Something must be done! This is something!
But then you're left wondering: why would we deploy a protocol that took profound tradeoffs to facilitate offline signing, when it turns out most of the real-world use cases were going to be online? If the protocol had been designed for online signers in the first place, it would be cleaner and more powerful in a bunch of different ways.
Instead, DNSSEC advocates propose that --- despite the fact that the industry has essentially not meaningfully deployed the protocol yet, after 25 years of standardization effort --- we just say "fuck it" and deploy this 90s protocol anyways. Something must be done! This is something!