The DNSSEC Root Signing Ceremony

Re:The DNSSEC Root Signing Ceremony by PinguTS on Thursday November 12, 2015 @06:18AM (#10552472)

I agree. The interesting thing here is not even code injected into the laptop, but about fake writes.

Because the article states, that Verisign provide their KSR via the USB, which is than is PGP signed and that signature is checked visually.

But what about, when the DNSSEC signatures are written to the USB stick, which then is handed over to Verisign to be implemented. They are also checked visually? Or can the USB stick (the implemented logic) forge the write and basically modify the written results?

[ Parent | on HN ]

Re:The DNSSEC Root Signing Ceremony by scintill76 on Thursday November 12, 2015 @07:14AM (#10552652)

I don't understand the purpose of such an attack. The USB stick can't forge a signature (not even the laptop has the key -- it's in the HSM.) If it corrupted the signature by lying about the writes, they could just re-write on new media.

[ Parent | on HN ]