> that the hardware involved in the actual key rollover complies to the highest level specified by FIPS-140 (presumably actually FIPS-140-2).

Eww, FIPS-140-2.

FIPS-140 compliance isn't a selling point. It's more of a genetic marker than anything. Most of the time, it signals to hackers, "we value standards compliance over security."

Did you know that ECB mode is FIPS-140-2 approved, but AEAD modes (i.e. what you should be using to encrypt) such as GCM and OCB are not?

Yes, that ECB mode. https://blog.filippo.io/the-ecb-penguin/

The very word "Ceremony" is a hint to the theatrics and purpose of the DNSSEC root key procedures. It's more about incanting a sense of authority in the integrity of DNS and creating the impression that DNSSEC provides some kind of transitive trust; if the procedures at the top are this robust, then that security and sense of legitimacy must flow down.

But in reality lookups to the root DNS zone are very uncommon; resolvers perform them only when occasionally boot-strapping the name-servers for the TLDs.

An attacker using a poisoned root zone to take over your traffic would have to wait between two days and a week for it to work, so it's not very interesting for a direct attack. A mass poisoning is even less useful: there is a relatively small number of TLDs and any false answers would be detected very quickly (the occasional operational mismatch is reported within minutes on DNS operations mailing lists). And if your goal is to block some DNS names, as happened in Turkey a few years ago, it's easier to simply drop the queries and responses for the domains you don't like; signing doesn't provide any help at all. Bottom line: the root zone is not very security sensitive, there aren't interesting attacks to mitigate in the first place, and none that TLS/SSL don't take care of.

Queries against the TLDs on the other hand are much more common; but what are the procedures for the .com/.net roll-over? or .ly? where are the live-video feeds for that zone signing ceremony? are there people walking around with Shamir-split copies of those keys around their necks and wearing them as if they were the guardian of the internet?

Perhaps slightly off topic, but I recall that the LibreSSL guys dropped FIPS entirely[1] due to technical and political concerns.

With that in mind, shouldn't meeting those specifications be seen as an antipattern?

[1]: http://marc.info/?l=openbsd-misc&m=139819485423701&w=2

And relevant HN thread: https://news.ycombinator.com/item?id=7634964

> I don't believe there's reason to be worried;

The only thing I see as a potential concern is that many DNS implementations build the root public key into the server, either at installation or at compile time.

The processes for rotating that key will be tested in the wild for the first time. I can only assume that some set of build/installation processes will have an undiscovered bug during this procedure.

Is it a big deal? Not really, I bet it would be fixed within a few hours.

...I think they mean 'should we be worried' that DNS will break due to the change. The article didn't really answer that though, instead just outlines the ceremony that takes place.

Does the key change frequently?

No, it doesn't change frequently. The article mentions that this is the first time it's changing.

The keys are stored in a FIPS 140-2 Level 4 HSM.