Ups...
https://www.theregister.co.uk/2020/02/13/iana_dnssec_ksk_delay/
Internet's safe-keepers forced to postpone crucial DNSSEC root key signing ceremony – no, not a hacker attack, but because they can't open a safe
Online security process stalled by offline security screw-up
By https://www.theregister.co.uk/Author/Kieren-McCarthy Kieren McCarthy in San Francisco 13 Feb 2020 at 06:09
The organization that keeps the internet running behind-the-scenes was forced to delay an important update to the global network – because it was locked out of one of its own safes.
“During routine administrative maintenance of our Key Management Facility on 11 February, we identified an equipment malfunction,” explained Kim Davies, the head of the Internet Assigned Numbers Authority ( https://www.iana.org/about IANA), in an https://mm.icann.org/pipermail/root-dnssec-announce/2020/000121.html email to the dozen or so people expected to attend a quarterly ceremony in southern California at lunchtime on Wednesday.
The malfunction “will prevent us from successfully conducting the ceremony as originally scheduled" on February 12, Davis explained. “The issue disables access to one of the secure safes that contains material for the ceremony.” In other words, IANA locked itself out.
The ceremony sees several trusted internet engineers (a minimum of three and up to seven) from across the world descend on one of two secure locations – one in El Segundo, California, just south of Los Angeles, and the other in Culpeper, Virginia – both in America, every three months.
Once in place, they run through a lengthy series of steps and checks to cryptographically sign the digital key pairs used to secure the internet’s root zone. (Here's https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/ Cloudflare's in-depth explanation, and IANA's https://data.iana.org/ksk-ceremony/40/20200212-KC40_Ceremony_Script.pdf PDF step-by-step guide.)
At the heart of the matter, simply put, is the Key Signing Key (KSK): this is a public-private key pair, with the private portion kept locked away by IANA. This is because the KSK is used, every three months, to sign a set of Zone Signing Keys, which are used to secure official copies of the internet's root zone file. That file acts as a kind of directory for other parts of the internet, and these parts in turn, provide information on more of the internet. It is, in a way, the blueprint for how the internet as we know it is glued together: how domain names resolve to computers on the global network, so that when you visit, say, theregister.co.uk, you eventually reach one of our servers at network address 104.18.235.86.
Critical root DNS servers are spread out around the planet, each armed with a copy of the latest signed root zone file, and used, in a distributed, cascading manner, by other DNS servers to look up domain names for the internet's users. These servers can check the root zone file underpinning all of this is secured by a ZSK recently signed by the central IANA KSK, and thus can be treated and trusted as gospel. The KSK is thus the domain-name system's trust anchor. Everything relies on it to ensure the 'net's central directory is laid out the way it should be, according to IANA, anyway.
This is all necessary because it should be immediately obvious whether or not a root zone file is an unsigned forgery, or an authentic and clean copy secured by IANA's KSK. Otherwise, a well-resourced malicious organization could potentially fool networks into using a sabotaged root zone file that redirects vast quantities of traffic, i.e. billions of internet users, to different parts of the internet. Even worse, if someone were to get hold of the KSK, they could sign their own zone file and have the internet blindly trust it. The result would be a global loss of trust in the 'net's functioning.
Security up the wazoo
For that reason, IANA takes its Root Key Signing Key Ceremony extremely seriously, and has a https://www.iana.org/dnssec/icann-dps.txt complex and somewhat convoluted DNSSEC-based https://www.iana.org/dnssec process that briefly unlocks the private portion of the KSK to sign the ZSKs every three months. Only during this ceremony is the KSK used, and put away again when it is over, leaving IANA with a set of ZSKs to authoritatively secure its root zone.
Only specific named people are allowed to take part in the ceremony, and they have to pass through several layers of security – including doors that can only be opened through fingerprint and retinal scans – before getting in the room where the ceremony takes place.
Staff open up two safes, each roughly one-metre across. One contains a hardware security module that contains the private portion of the KSK. The module is activated, allowing the KSK private key to sign keys, using smart cards assigned to the ceremony participants. These credentials are stored in deposit boxes and tamper-proof bags in the second safe. Each step is checked by everyone else, and the event is https://www.youtube.com/watch?v=erfsFJsapAs livestreamed. Once the ceremony is complete – which takes a few hours – all the pieces are separated, sealed, and put back in the safes inside the secure facility, and everyone leaves.
https://www.theregister.co.uk/2019/10/28/arin_rpki_open_source/
https://www.theregister.co.uk/2019/10/28/arin_rpki_open_source/ You're ARIN a laugh: Critical internet org accused of undercutting security over legal fears
https://www.theregister.co.uk/2019/10/28/arin_rpki_open_source/ READ MORE
But during what was apparently a check on the system on Tuesday night – the day before the ceremony https://www.iana.org/dnssec/ceremonies/40 planned for 1300 PST (2100 UTC) Wednesday – IANA staff discovered that they couldn’t open one of the two safes. One of the locking mechanisms wouldn’t retract and so the safe stayed stubbornly shut.
As soon as they discovered the problem, everyone involved, including those who had flown in for the occasion, were told that the ceremony was being postponed. Thanks to the complexity of the problem – a jammed safe with critical and sensitive equipment inside – they were told it wasn’t going to be possible to hold the ceremony on the back-up date of Thursday, either.
We understand, however, that following an emergency meeting on Wednesday, the issue should be fixed by Friday, and the ceremony has now been moved to Saturday. In the meantime, some lucky locksmith in Los Angeles is going to have to drill out the safe’s locking mechanism and put in a new one.
Fortunately, apart from the inconvenience, there is no impact on the internet itself, particularly in this short term. The current arrangement will simply continue to do its job for three additional days. And IANA has been keen to point out that it has an identical set of equipment on the other coast of the US that can also be used if necessary.
“We apologize for the inconvenience for the attendees who had already traveled to participate in the ceremony. This is the first time a ceremony has needed to be rescheduled in the 10-year history of KSK management,” the email announcing the delay noted.
There is a certain irony, of course, that the security of the virtual internet has been held hostage by an old-school physical safe. ®
Sponsored: https://go.theregister.co.uk/tl/1877/shttps:/mcubed.london/?utm_source=theregister&utm_medium=textlink&utm_campaign=mcubed2020 M3 - The ML, AL and Analytics Conference from The Register
Sent from my iPad 2018