Re:DNSSEC failures are how you get people to disable DNSSEC
by teddyh on Thursday June 01, 2023 @07:35AM
(#36149799)
A (potential) key compromise can result from more things than an employee leaving. It can also be due to, say, an algorithm change. HSMs do not solve this (and in fact probably make it harder to change the encryption algorithm).
[ Parent
| on HN ]
Re:DNSSEC failures are how you get people to disable DNSSEC
by mike_hearn on Thursday June 01, 2023 @09:41AM
(#36150899)
Why do HSMs make it harder? Algorithm changes are rare, and when they happen you'd need to upgrade all the clients that are working with the keys or certificates, so at that point it's a question of software rotation rather than key rotation. The HSM shouldn't be your biggest problem at that point.