Re: [dnsext] Authenticated denial of existence...

[Jelte Jansen <[e-mail]>]

On 11/25/2013 04:43 PM, Tony Finch wrote:
> Miek Gieben <[e-mail]> wrote:
> 
>> Matthijs and I added an extra appendix to cover on-line signing and
>> made some tweaks to the rest of the text.
> 
> Looks good.
> 
> A point I just noticed in section 3 which I think could do with
> elaborating:
> 
>       Given all these troubles, why didn't the designers of DNSSEC go
>       for the (easy) route and allowed for on-line signing?  Well, at
>       that time (pre 2000), on-line signing was not feasible with the
>       then current hardware.  Keep in mind that the larger servers get
>       between 2000 and 6000 queries per second (qps), with peaks up to
>       20,000 qps or more.  Scaling signature generation to these kind of
>       levels is always a challenge.  Another issue was (and is) key
>       management, for on-line signing to work you need access to the
>       private key(s).  This is considered a security risk.
> 
> I think it is worth saying that online signing makes it difficult to have
> third party secondary authoritative servers, since they would need a copy
> of the private ZSK. With normal DNSSEC, even with a dynamically updated
> zone, the private keys do not need to be on a publicly accessible machine.
> 

now that you quote it like that, I think that using 'allowed' in that
first line is misleading; it's not so much that the protocol doesn't
allow on-line signing, the requirement was that it didn't have to rely
on it. Also, IIRC the preferred term was on-the-fly rather than on-line.

Need to re-read doc :)

Jelte