News for hackers. Stuff that matters.
Re:The DNSSEC master key securing DNS is about to change by guessmyname on Monday August 29, 2016 @10:50AM (#12382192)
What is the security like in these meetings? Is any security agency taking part on these ceremonies? What is preventing a terrorist group to launch an attack against this people considering the importance of all of them? I am probably exaggerating because all this reminds me of the not-so-old movies about hacking a la "Mission: Impossible" film series. Do they say that the meeting is going to take place in one place — like in the article it says El Segundo, CA — but actually meet elsewhere? Do the key holders have security 24/7 in their respective countries to prevent stolen keys?

Again, I am misunderstanding the information here, but the keys are actually useless, even if you get your hands on all of them to attempt an incursion against the building where the KSK is, you would not be able to do anything because the security of that place is probably good enough to counter an attack like that, and supposing the attack takes place the other DNS servers would simply disconnect from the root and serve the information that they have until it gets outdated. So the only scenario that I can picture in my head is one where a terrorist attack goes against the building to disrupt the functionality of the whole system for anarchy reasons.

Re:The DNSSEC master key securing DNS is about to change by mino on Monday August 29, 2016 @10:58AM (#12382246)
IANA's keeps this archive of all the proceedings, signed logs, and even multi-camera recordings of the signing ceremonies:

https://www.iana.org/dnssec/ceremonies

CloudFlare has published an account:

https://www.cloudflare.com/dnssec/root-signing-ceremony/

Re:The DNSSEC master key securing DNS is about to change by kijeda on Monday August 29, 2016 @11:25AM (#12382475)
The security is designed to guard against surreptitious access. Interested members of the public are welcome to attend ceremonies (availability on a first-come first-served basis).

There are multiple redundant sites and backups of the keys, so an attack aimed at destroying a site should not alone be a problem. Even if all all sites and backups were destroyed, there is a window where a new key can be constructed (approximately between 3-6 months worth of operational zone-singing keys are prepared in advance for the root zone).

Re:The DNSSEC master key securing DNS is about to change by CiPHPerCoder on Monday August 29, 2016 @11:34AM (#12382558)
One window of vulnerability is the after-party where everyone with a piece of the signing key drinks cocktails together.
Re:The DNSSEC master key securing DNS is about to change by kijeda on Monday August 29, 2016 @11:43AM (#12382640)
Ceremony attendees don't leave with part of the signing key.

Despite the folklore around these ceremonies that there are 7 people with "the keys to the Internet", those seven only retain a metal key that is used to access a safety deposit box in the ICANN/IANA facility, each of which contains a smart card of which there is an "m-of-n" configuration to activate HSMs containing the actual key.

Re:The DNSSEC master key securing DNS is about to change by CiPHPerCoder on Monday August 29, 2016 @12:59PM (#12383248)
Thanks for the correction. :)
Re:The DNSSEC master key securing DNS is about to change by bluejekyll on Monday August 29, 2016 @10:57AM (#12382242)
This is the human equivalent of an HSM.