576K views · Jun 18, 2010 · 6:30 · 0 HN recommenders · 3 mentions · discussed 2013–2014
Highlights of the June 2010 ICANN DNSSEC root Key Signing Ceremony, showing the procedures used to generate and protect the root zone signing key.
Why Hacker News points people here: HN cites it to show how seriously root key ceremonies are secured and to let people watch one.
“The key ceremony is video taped and can be watched”HN comment, 2014
“CA Certificate generation is about as secure as the papal election”
Shows how secure root key generation ceremonies are.
Not very likely. CA Certificate generation is about as secure as the papal election (read one of the most secure proceedings in existence). See this video
“There's a video of the entire ceremony online somewhere”
Summary of the entire key ceremony video.
Well we have a hell of a lot more transparency about where that key is, who generated and has access to it. There's a video of the entire ceremony online somewhere, at the moment I can only find [this summary]( this video )
“The key ceremony is video taped and can be watched”
Key ceremony is video taped and can be watched.
I thought your first comment was just grumbling, but this comment suggests some misunderstanding. The root zsk is split over a group (Shamir share) held by mostly non-US key holders. (One from the US is Dan Kaminsky, whose work and my user name has special relevancy for you. You'd agree he's not part of the US government.) I believe all the key holders are trustworthy, and if any were not, you'd need a majority (5 of the 7) to subvert the zsk. So an xkcd-wrench-style attack on the key by governments would require implausible circumstances. The key ceremony is video taped and can be watched: this video Other TLDs (some being countries) also hold key signing ceremonies and video tape them. You can watch other countries perform key signing as well. But these sovereign zsks are subordinate to the ICANN community held keys. I.e., it's more accurate (than your statement) to say that there are seven people walking the earth who have parent keys over actual country soveriegn zones. And while you might not know all these people yourself, they're from the DNS operator and hacker community. If anything, you're 180 degrees wrong in your statement that governments run DNSSEC. You can read more about the DNSSEC root zone key management process and people (non-governmental) online. Here are informal press stories with the usual set of mistakes and minor errors: link link And the root DNSSEC operation in general: link I don't see the government in DNSSEC. Not even ICANN can alter the root
