This year I was selected to be one of ICANN’s TCRs, the Trusted
Community Representatives, to participate in the DNS Root Signing
Ceremony. My particular role is to be Cryptographic Officer,
responsible for guarding 1 of the 7 keys that allow access to the KSK.
In this article I want to explain what this job is about, oriented to
people without deep technical knowledge in DNS/DNSSEC.
1. What is the root signature about?
DNS is the protocol that allows domain names to function on the
Internet. Through DNSSEC, digital signatures can be added to the DNS,
so that any message carries a certificate of validity, which can be
verified in real time by anyone who has access to those messages.
In this way, the DNS lets you know that www.fao.org is a website
located at IP address 104.18.24.133, and DNSSEC adds a digital
signature that certifies that the response was created by the World
Food and Agriculture Organization, and that it is correct and complete.
For this certification, cryptographic keys are used, pieces of
mathematical information that allow that only the authorized person can
create signatures, and that anyone on the Internet can be able to
verify them. Making a parallel with signatures in the real world, only
you can draw your signature (no one can copy your strokes or the way
you draw it), and we are all specialized experts who can verify that it
is real and correct; and that no one copied it from somewhere else.
The DNS is hierarchical, in the sense that all the information starts
from a root, and from there it is distributed to the rest of domain
names. Following the example, www.fao.org is a name that is part of the
fao.org domain, which in turn is part of the org domain, which is
finally part of the root. Each organization is responsible for each
label. www.fao.org is created and managed by FAO, whatever happens in
org is created and managed by a body called PIR, and whatever happens
in the root is managed by ICANN, the body in charge of the DNS root.
This same hierarchy is used for signatures. To verify that the DNS
message from www.fao.org has correct signatures, it is checked that the
mathematical proof is valid, using the FAO keys. But how do we trust
the FAO keys? We have to go to their parent .org, who certifies that
the fao.org key is correct. And how do we know that the org key is
correct? We go to its parent, the DNS root, which certifies that the
org key is correct. And finally, how do we verify that the root key is
correct? Here there are no more parents, so this key has to be known
all over the Internet. And this is how any computer, server, phone, or
any device that uses DNSSEC, must know this last key, mother of all.
So we finally come to answer the original question: what is root
signing? It is the creation of keys and digital signatures using
cryptographic keys of the DNS root, which is the origin of the
verification chain of all domain names on the Internet.
2. What are the ceremonies?
Root signing ceremonies are meetings where DNS root keys are accessed.
In some ceremonies, new keys are created, in others the keys are
signed, and there are also administrative activities such as backups,
copying between different devices, and so on.
As you might suspect, this work has to be done very carefully. The keys
are stored in specialized devices, called “HSMs” (Hardware Security
Modules), boxes that are capable of generating keys and signing, and
have extreme security controls. HSMs have internal devices that prevent
them from being opened, knocked, and any physical tampering. In the
event of any of these acts, they are automatically erased. To
communicate with them, a special protocol is needed, they do not
connect to any kind of network, let alone the Internet! Finally, in
order to activate the HSMs, smart cards are needed, which are guarded
by different people, and a minimum quorum is required to operate. This
prevents anyone from activating them on their own, and requires a
minimum number of other people, which prevents collusion.
Ceremonies are very controlled activities. Everything that is done must
be written in a script, from the entrance to the room to the
step-by-step of all activities. This script is available to anyone who
wants to review it, and there are different people who audit and
certify that it was followed correctly. IANA is certified for two
external audits per year.
On the other hand, the HSMs are stored inside anti-intrusion bags, and
then inside safes. The safes are inside a cage with restricted access,
and this cage is in a special office in a data center guarded by armed
guards.
IANA maintains two such facilities, each with a copy of the
information. One is on the east coast of the United States (near
Washington DC), and the other is on the west coast, in Los Angeles.
3. What is my job there?
The TCRs are selected from different parts of the world, to represent
the whole community. Currently there are 4 of us from Latin America,
who share different roles and are divided between the two locations
where the ceremonies are held.
As indicated in the previous question, to activate the HSM a quorum of
smart cards is needed. These cards are guarded by “Cryptographic
Officers”, and it is necessary that of the seven officers, at least
three are present to activate them.
That is why my job as CO is to attend the ceremonies, present the card
to the ceremony administrator, and certify that the activities that
take place are faithful to the script. Finally, it is also important to
make sure that the HSMs are deactivated after use, stored properly in
their bags and safes, and guard the card until the next ceremony.
4. Where can I learn more?
IANA maintains a site where all the policies, procedures, and scripts
that control root signing ceremonies are publicly available:
IANA DNSSEC Information.
You will also find the material for each ceremony, including the script
with written notes, and a video of the entire activity! This video is
streamed in real time and anyone can follow it, and there is even an
expert present to answer your comments, so you can take advantage of
the opportunity to ask questions right there.
5. This all looks like something out of a movie, doesn’t it?
Of course there was quite a stir about “the seven keys that control the
Internet” :) There are quite a few
press
releases
and
articles,
some more accurate than others.
And actually it has already appeared in some episodes of series ;)
Here’s a
scene from the
2017 series “The Blacklist Redemption”, and
another from
“Elementary”.
There was also a visit from a famous Youtuber, who made
a couple of notes.
And on a more serious side, the BBC made a documentary, of which I
only got
the first few seconds.
]]>
(imagen tomada del estudio The 2024-2026 Root Zone KSK Rollover: Initial Observations and Early Trends
)
