3 ms·
The DNSSEC Root Signing Ceremony
- EvanAnderson 4y agoPast ceremonies are archived on Youtube[0]. I haven't watched any front-to-back, but I do enjoy watching bits and pieces. I enjoy watching people taking a rigorous procedure seriously. An HSM was purposefully destroyed after being zeroed during ceremony 45[1]. That was a fun bit. The HSM is "drop tested" before being disassembled. I had occasion to commission some HSM devices and generate some keys as part of an engagement with a Customer a few years ago. I tried to model our ceremony after the IANA procedure. (As a contractor generating keys to protect a "revenue model" for a 20+ year product lifecycle I was immensely concerned there be sufficient evidence to show I could not possibly have secreted away copies of the keys during the commissioning ceremony. If those keys get compromised sometime in the future I don't want to be on the hook as a suspect.) [0] https://www.youtube.com/channel/UChND9hEeJQjtLDFZ-m8U47A https://www.youtube.com/channel/UChND9hEeJQjtLDFZ-m8U47A [1] https://youtu.be/Kj1dbn9a2uc?t=13754 https://youtu.be/Kj1dbn9a2uc?t=13754