6 ms·

The DNSSEC Root Signing Ceremony

88 points by jgrahamc 11y ago

tptacek 11y ago
Access requires the cooperation of 7 individuals, all of whom must be present for a Root Signing Ceremony to take place: The Ceremony Administrator An Internal Witness The Credentials Safe Controller The Hardware Safe Controller Crypto Officer #1 Crypto Officer #2 Crypto Officer #3 Fascinating. What's the signing ceremony for .IO look like? .COM? .NET? .CO.UK? .COM.AU?
- Laforet 11y ago
  It will probably involve a similar roll of controllers, plus supervisors/representatives from operators of all DNS root servers[0]. [0]:https://lwn.net/Articles/647459/ https://lwn.net/Articles/647459/
- swiley 11y ago
  .com and .net are pretty similar if I understand correctly.
- josteink 11y ago
  > Fascinating. What's the signing ceremony for .IO look like? For a minor novelty TLD abused by tech hipsters because "IO sounds cool", I suspect there's no ceremony at all.
ta0o0o0 11y ago
So how is this logically different than the replacement of all CAs with a single one?
- admax88q 11y ago
  This was talked about a lot on the last DNSSEC story on HN. I don't have a link to the story but this site was linked to from discussions. http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01/15/against-dnssec/ DNSSEC does seem pretty unnecessary at this point for security. It hands more power over the internet to fewer hands, whilst not providing any improved security.
  - yuhong 11y ago
    I have suggested DNSSEC2 several times and it would likely use ECC not RSA. At least the root keys are 2048-bit RSA now, right?
    - ryan-c 11y ago
      The DNS root is signed with a 1024 bit key, currently: -----BEGIN RSA PUBLIC KEY----- MIGJAoGBALgVvZmZibtBpha3AIykU0OY4gcCXTcskYJUxGsdmV/awfmKcHlSrjNM ioSgy4sByj+HpcbsyrZVGPp+JBXzYwwuEF/6w1k7vKYTK6vMSqgVcgooNkfb5MaR F2y7MEpPxfStnfwu8knE24ExB0hYE1URxJ9CqB3zMSl/vicXYXXlAgMBAAE= -----END RSA PUBLIC KEY----- That key - the zone signing key - is signed with the key signing key, which is 2048 bits.
  - wtallis 11y ago
    DNSSEC only seems unnecessary under the assumption that you're already making full use of existing security measures everywhere else in the stack. If you live in a world where unencrypted HTTP still exists then it's nice to have some defense against ISPs who like to lie in DNS responses. And even if I am connecting over HTTPS through a shady ISP, I'd prefer not to send any packets at all to the wrong IP rather than wait until it presents the wrong certificate.
    - chimeracoder 11y ago
      > If you live in a world where unencrypted HTTP still exists then it's nice to have some defense against ISPs who like to lie in DNS responses. As tptacek and others have pointed out numerous times elsewhere on HN (and in the article linked above): 1. DNSSEC doesn't protect against ISPs hijacking DNS responses 2. TLS is easier to deploy than DNSSEC 3. TLS provides more security for the end user than DNSSEC does 3a. If TLS us used, DNSSEC provides essentially no additional security benefits to the end user. So really, it makes sense to be advocating the use of TLS, which is what projects like Let's Encrypt are all about. DNSSEC is at best a waste of resources that could be better spent on actually securing the Internet through TLS, and at worst actively harmful (because the strongest criticism of TLS is that it centralizes trust in CAs, and DNSSEC centralizes trust even further - in a single entity!) > I'd prefer not to send any packets at all to the wrong IP rather than wait until it presents the wrong certificate. I'm not sure what difference it makes to be sending packets to the wrong IP. The whole point of TLS is that it doesn't really matter, because they can't read what you're sending anyway. Also, the way the Internet works, you're always sending packets through the "wrong" IP addresses, so you should make the assumption that your raw traffic is visible to to any eavesdropper (and therefore encrypt your traffic so that this is not an issue).
- toast0 11y ago
  DNS is already a a distributed chain of trust. I trust that the well know ftp site will give me a good hints file to get to the root servers. I trust that the root servers will provide me with the proper ns and glue records for the tld servers. I trust that the tld servers will provide the correct ns and glue records for the domain I want to resolve. DNSSEC just formalizes the trust with digital signatures. A traditional CA validates empirically that a customer controls a domain at some point in time. DNSSEC is a stronger validation of control of the domain, because it's a property of the domain itself. Trusting the domain registry to indicate who controls a domain makes a lot more sense to me than trusting a third party. If I can't trust the DS records, I can't trust the NS records either. A DS record doesn't indicate a connection between an organization and a domain though, which a traditional CA supposedly might.
  - deathanatos 11y ago
    > A DS record doesn't indicate a connection between an organization and a domain though, which a traditional CA supposedly might. Only if you get an EV certificate, no? My understanding is that the only checks required for getting a normal certificate issued is to verify that the person holding the key that you're signing is in control of the domain. (Verified through methods such as setting particular DNS records, proving control of the email on the WHOIS data, or setting up an HTTP server at a particular DNS address.) Then again, most sites just use a basic cert, so perhaps DNSSEC provides most of what is needed.
    - toast0 11y ago
      Some of the certificates I've purchased have involved verifying some details of the organization, even though they weren't EV. I believe we needed a Dun and Bradstreet number when I got a certificate from Thawte in the late 90s (although I might be misremembering, something at that company needed that number...). And a more recent issuance wanted some other proof of existence / location, they had asked for a lease/utility bill, but issued with our location found in a state corporation database, before I could get a copy of something they would accept. I won't disclose the issuer of the recent cert, but I would put them in the top tier of reputation (and prices). I would hope an EV process would do a better verification, but I've never needed an EV cert, so I don't know. DNSSEC is sort of like verifying to everyone that you control the DNS, near the time of use, as opposed to just verifying to a CA at time of issuance. Or in other words, if it's OK for a CA to trust DNS, letting everyone else trust it would be good too. At least the concept is right, 1024-bit rsa keys are kind of scary. And DNSSEC doesn't address confidentiality, but TLS with SNI also leaks hostnames.
- tptacek 11y ago
  It is in no way logically different.
- nmc 11y ago
  As mentioned by admax88q, this was extensively discussed a few months ago on HN: https://news.ycombinator.com/item?id=8894902 https://news.ycombinator.com/item?id=8894902
Fuzzwah 11y ago
I can imagine a Neal Stephenson book which makes a number of 50 year jumps into the future and explains how this ceremony becomes more and more religious in nature. Toss in a few dramatic changes based on either fanciful ideas of new ways to compromise the process or in reaction to actual attack attempts (or successes).
yeukhon 11y ago
So they are actually holding a physical key? Am I misreading the article? I am just imagining the case when people all get kidnapped... How do you become the crypto officer? What are their credentials? How often do you change the people?
jcox92 11y ago
The Guardian did a piece on this last year including a video of part of the ceremony: http://www.theguardian.com/technology/2014/feb/28/seven-people-keys-worldwide-internet-security-web http://www.theguardian.com/technology/2014/feb/28/seven-peop...
- cstuder 11y ago
  And fun anecdotes like: At 21.29, things go awry. A security controller slams the door of the safe shut, triggering a seismic sensor, which in turn triggers automatic door locks. The ceremony administrator and the keyholders are all locked in an 8ft square cage.
scintill76 11y ago
> The only way to move information from the outside world into the laptop/HSM is via USB drive. Accordingly, the key-signing request is loaded into the laptop via USB. Hmm, how sure are they that the OS only allows USB drives (as opposed to keyboards, network controllers, etc.), and contains no exploitable bugs? Is an image of the media the laptop was booted from publicly available, and has it been audited? I almost feel silly asking, given all the time spent designing this and how smart the people are, but after all that trouble it seems amateurish to use USB...
- escape_goat 11y ago
  I too do not know enough to not feel silly for asking this, but I have a similar feeling, and I am not sure if I have misunderstood the past year's worth of popular articles on USB security, the risk posed by the USB in the context of the ceremony, or both. I had gotten the impression that the firmware vulnerabilities of USB flash drives had proven to be inherent, unavoidable, and utterly devastating; that, basically, any given USB drive could become a general-purpose bus-querying hostile computing device, if once plugged into a machine controlled by a capable and motivated adversary. If that understanding was correctly received, and given the strength of potential motivation involved here, my thought is that the problem presented by the USB drive could only be combated by (a) ensuring that the USB drive was obtained in a random enough fashion that vast numbers would need to be deliberately compromised with this specific target in mind for that approach to be feasible, and (b) ensuring that the USB drive was neither ever unsupervised nor connected to any USB port (except one on a "known-to-be-clean" computer) after the selection occurred. The problem that I see with those measures is that if compromising the laptop with a compromised USB drive were possible, then the actual security of the process would be purely dependent on the security of measure (b), as established by a single actor at the ceremony: that is, whomever provides the USB with the key-signing request. This last point just by itself would seem to be a degree of risk well beyond the criteria implied by the established protocol.
  - leni536 11y ago
    I don't know too much about badusb, but I think some mitigation is possible. 1. Use an USB key that doesn't have an updateable firmware. 2. Configure the laptop to only accept a single USB mass storage device on a dedicated port. No keyboard, no mouse. I should be possible with udev rules.
deleted 11y ago
[deleted]
natch 11y ago
It's amusing that their plexiglass labeled holder for the OS DVD has OS misspelled as O/S. I believe this misspelling most likely stems from people having seen and slightly jumbled part of the name of the old IBM branded operating system, OS/2.
- dragonwriter 11y ago
  I occasionally saw operating system abbreviated that way before OS/2 existed, and obviously OS/2 doesn't do that, so I am not inclined to believe there's a connection.
- JdeBP 11y ago
  It is a usage that has been fairly widespread in computing literature since at least the early 1970s, pre-dating OS/2 by at least a decade and a half (possibly more). Such abbreviations punctuated by slash have been acknowledged widely even without the realm of computing (and for decades longer) in quite a number of manuals of punctuation and style. And they're still acknowledged today. Merriam-Webster's Pocket Guide to Punctuation and New Hart's Rules give examples of slash-punctuated abbreviations including N/A, c/o, w/o, and A/C. The amusing thing is to see it being mis-categorized a mis-spelling based upon OS/2 of all things. You could at least have picked OS/360 or something. (-:
cflee 11y ago
The next KSK Ceremony is happening today (12 November 2015, 18:00 UTC): https://www.iana.org/dnssec/ceremonies/23 https://www.iana.org/dnssec/ceremonies/23
ge0rg 11y ago
Okay, so this tremendously complicated and secure ceremony is performed to essentially sign a "Verisign is allowed to do whatever they deem appropriate to the root of DNS in the next six months" certificate. This is really just security theatre, as all the power is delegated to Verisign, and it is almost impossible to detect Zone Signing Key abuse.
- SolarNet 11y ago
  Except that verisign is also replaceable in this whole thing. If they ever screw up they can easily be replaced.
larrysalibra 11y ago
This silly signing ceremony shows the fragility of a centralized trust model. If bitcoin/blockchain succeeds this hopefully will be relegated to the history books.

88 points by jgrahamc 11y ago

Access requires the cooperation of 7 individuals, all of whom must be present for a Root Signing Ceremony to take place: The Ceremony Administrator An Internal Witness The Credentials Safe Controller The Hardware Safe Controller Crypto Officer #1 Crypto Officer #2 Crypto Officer #3 Fascinating. What's the signing ceremony for .IO look like? .COM? .NET? .CO.UK? .COM.AU?

Laforet 11y ago
It will probably involve a similar roll of controllers, plus supervisors/representatives from operators of all DNS root servers[0]. [0]:https://lwn.net/Articles/647459/ https://lwn.net/Articles/647459/
swiley 11y ago
.com and .net are pretty similar if I understand correctly.
josteink 11y ago
> Fascinating. What's the signing ceremony for .IO look like? For a minor novelty TLD abused by tech hipsters because "IO sounds cool", I suspect there's no ceremony at all.

ta0o0o0 11y ago

So how is this logically different than the replacement of all CAs with a single one?

admax88q 11y ago
This was talked about a lot on the last DNSSEC story on HN. I don't have a link to the story but this site was linked to from discussions. http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01/15/against-dnssec/ DNSSEC does seem pretty unnecessary at this point for security. It hands more power over the internet to fewer hands, whilst not providing any improved security.
- yuhong 11y ago
  I have suggested DNSSEC2 several times and it would likely use ECC not RSA. At least the root keys are 2048-bit RSA now, right?
  - ryan-c 11y ago
    The DNS root is signed with a 1024 bit key, currently: -----BEGIN RSA PUBLIC KEY----- MIGJAoGBALgVvZmZibtBpha3AIykU0OY4gcCXTcskYJUxGsdmV/awfmKcHlSrjNM ioSgy4sByj+HpcbsyrZVGPp+JBXzYwwuEF/6w1k7vKYTK6vMSqgVcgooNkfb5MaR F2y7MEpPxfStnfwu8knE24ExB0hYE1URxJ9CqB3zMSl/vicXYXXlAgMBAAE= -----END RSA PUBLIC KEY----- That key - the zone signing key - is signed with the key signing key, which is 2048 bits.
- wtallis 11y ago
  DNSSEC only seems unnecessary under the assumption that you're already making full use of existing security measures everywhere else in the stack. If you live in a world where unencrypted HTTP still exists then it's nice to have some defense against ISPs who like to lie in DNS responses. And even if I am connecting over HTTPS through a shady ISP, I'd prefer not to send any packets at all to the wrong IP rather than wait until it presents the wrong certificate.
  - chimeracoder 11y ago
    > If you live in a world where unencrypted HTTP still exists then it's nice to have some defense against ISPs who like to lie in DNS responses. As tptacek and others have pointed out numerous times elsewhere on HN (and in the article linked above): 1. DNSSEC doesn't protect against ISPs hijacking DNS responses 2. TLS is easier to deploy than DNSSEC 3. TLS provides more security for the end user than DNSSEC does 3a. If TLS us used, DNSSEC provides essentially no additional security benefits to the end user. So really, it makes sense to be advocating the use of TLS, which is what projects like Let's Encrypt are all about. DNSSEC is at best a waste of resources that could be better spent on actually securing the Internet through TLS, and at worst actively harmful (because the strongest criticism of TLS is that it centralizes trust in CAs, and DNSSEC centralizes trust even further - in a single entity!) > I'd prefer not to send any packets at all to the wrong IP rather than wait until it presents the wrong certificate. I'm not sure what difference it makes to be sending packets to the wrong IP. The whole point of TLS is that it doesn't really matter, because they can't read what you're sending anyway. Also, the way the Internet works, you're always sending packets through the "wrong" IP addresses, so you should make the assumption that your raw traffic is visible to to any eavesdropper (and therefore encrypt your traffic so that this is not an issue).
toast0 11y ago
DNS is already a a distributed chain of trust. I trust that the well know ftp site will give me a good hints file to get to the root servers. I trust that the root servers will provide me with the proper ns and glue records for the tld servers. I trust that the tld servers will provide the correct ns and glue records for the domain I want to resolve. DNSSEC just formalizes the trust with digital signatures. A traditional CA validates empirically that a customer controls a domain at some point in time. DNSSEC is a stronger validation of control of the domain, because it's a property of the domain itself. Trusting the domain registry to indicate who controls a domain makes a lot more sense to me than trusting a third party. If I can't trust the DS records, I can't trust the NS records either. A DS record doesn't indicate a connection between an organization and a domain though, which a traditional CA supposedly might.
- deathanatos 11y ago
  > A DS record doesn't indicate a connection between an organization and a domain though, which a traditional CA supposedly might. Only if you get an EV certificate, no? My understanding is that the only checks required for getting a normal certificate issued is to verify that the person holding the key that you're signing is in control of the domain. (Verified through methods such as setting particular DNS records, proving control of the email on the WHOIS data, or setting up an HTTP server at a particular DNS address.) Then again, most sites just use a basic cert, so perhaps DNSSEC provides most of what is needed.
  - toast0 11y ago
    Some of the certificates I've purchased have involved verifying some details of the organization, even though they weren't EV. I believe we needed a Dun and Bradstreet number when I got a certificate from Thawte in the late 90s (although I might be misremembering, something at that company needed that number...). And a more recent issuance wanted some other proof of existence / location, they had asked for a lease/utility bill, but issued with our location found in a state corporation database, before I could get a copy of something they would accept. I won't disclose the issuer of the recent cert, but I would put them in the top tier of reputation (and prices). I would hope an EV process would do a better verification, but I've never needed an EV cert, so I don't know. DNSSEC is sort of like verifying to everyone that you control the DNS, near the time of use, as opposed to just verifying to a CA at time of issuance. Or in other words, if it's OK for a CA to trust DNS, letting everyone else trust it would be good too. At least the concept is right, 1024-bit rsa keys are kind of scary. And DNSSEC doesn't address confidentiality, but TLS with SNI also leaks hostnames.
tptacek 11y ago
It is in no way logically different.
nmc 11y ago
As mentioned by admax88q, this was extensively discussed a few months ago on HN: https://news.ycombinator.com/item?id=8894902 https://news.ycombinator.com/item?id=8894902

Fuzzwah 11y ago

I can imagine a Neal Stephenson book which makes a number of 50 year jumps into the future and explains how this ceremony becomes more and more religious in nature. Toss in a few dramatic changes based on either fanciful ideas of new ways to compromise the process or in reaction to actual attack attempts (or successes).

yeukhon 11y ago

So they are actually holding a physical key? Am I misreading the article? I am just imagining the case when people all get kidnapped... How do you become the crypto officer? What are their credentials? How often do you change the people?

jcox92 11y ago

The Guardian did a piece on this last year including a video of part of the ceremony: http://www.theguardian.com/technology/2014/feb/28/seven-people-keys-worldwide-internet-security-web http://www.theguardian.com/technology/2014/feb/28/seven-peop...

cstuder 11y ago
And fun anecdotes like: At 21.29, things go awry. A security controller slams the door of the safe shut, triggering a seismic sensor, which in turn triggers automatic door locks. The ceremony administrator and the keyholders are all locked in an 8ft square cage.

scintill76 11y ago

> The only way to move information from the outside world into the laptop/HSM is via USB drive. Accordingly, the key-signing request is loaded into the laptop via USB. Hmm, how sure are they that the OS only allows USB drives (as opposed to keyboards, network controllers, etc.), and contains no exploitable bugs? Is an image of the media the laptop was booted from publicly available, and has it been audited? I almost feel silly asking, given all the time spent designing this and how smart the people are, but after all that trouble it seems amateurish to use USB...

escape_goat 11y ago
I too do not know enough to not feel silly for asking this, but I have a similar feeling, and I am not sure if I have misunderstood the past year's worth of popular articles on USB security, the risk posed by the USB in the context of the ceremony, or both. I had gotten the impression that the firmware vulnerabilities of USB flash drives had proven to be inherent, unavoidable, and utterly devastating; that, basically, any given USB drive could become a general-purpose bus-querying hostile computing device, if once plugged into a machine controlled by a capable and motivated adversary. If that understanding was correctly received, and given the strength of potential motivation involved here, my thought is that the problem presented by the USB drive could only be combated by (a) ensuring that the USB drive was obtained in a random enough fashion that vast numbers would need to be deliberately compromised with this specific target in mind for that approach to be feasible, and (b) ensuring that the USB drive was neither ever unsupervised nor connected to any USB port (except one on a "known-to-be-clean" computer) after the selection occurred. The problem that I see with those measures is that if compromising the laptop with a compromised USB drive were possible, then the actual security of the process would be purely dependent on the security of measure (b), as established by a single actor at the ceremony: that is, whomever provides the USB with the key-signing request. This last point just by itself would seem to be a degree of risk well beyond the criteria implied by the established protocol.
- leni536 11y ago
  I don't know too much about badusb, but I think some mitigation is possible. 1. Use an USB key that doesn't have an updateable firmware. 2. Configure the laptop to only accept a single USB mass storage device on a dedicated port. No keyboard, no mouse. I should be possible with udev rules.

deleted 11y ago

[deleted]

natch 11y ago

It's amusing that their plexiglass labeled holder for the OS DVD has OS misspelled as O/S. I believe this misspelling most likely stems from people having seen and slightly jumbled part of the name of the old IBM branded operating system, OS/2.

dragonwriter 11y ago
I occasionally saw operating system abbreviated that way before OS/2 existed, and obviously OS/2 doesn't do that, so I am not inclined to believe there's a connection.
JdeBP 11y ago
It is a usage that has been fairly widespread in computing literature since at least the early 1970s, pre-dating OS/2 by at least a decade and a half (possibly more). Such abbreviations punctuated by slash have been acknowledged widely even without the realm of computing (and for decades longer) in quite a number of manuals of punctuation and style. And they're still acknowledged today. Merriam-Webster's Pocket Guide to Punctuation and New Hart's Rules give examples of slash-punctuated abbreviations including N/A, c/o, w/o, and A/C. The amusing thing is to see it being mis-categorized a mis-spelling based upon OS/2 of all things. You could at least have picked OS/360 or something. (-:

cflee 11y ago

The next KSK Ceremony is happening today (12 November 2015, 18:00 UTC): https://www.iana.org/dnssec/ceremonies/23 https://www.iana.org/dnssec/ceremonies/23

ge0rg 11y ago

Okay, so this tremendously complicated and secure ceremony is performed to essentially sign a "Verisign is allowed to do whatever they deem appropriate to the root of DNS in the next six months" certificate. This is really just security theatre, as all the power is delegated to Verisign, and it is almost impossible to detect Zone Signing Key abuse.

SolarNet 11y ago
Except that verisign is also replaceable in this whole thing. If they ever screw up they can easily be replaced.

larrysalibra 11y ago

This silly signing ceremony shows the fragility of a centralized trust model. If bitcoin/blockchain succeeds this hopefully will be relegated to the history books.