Signing the Internet root zone

on YouTube ↗43m

" summary

The root zone is root zone signed 2010 using HSMs, smart‑cards, tamper‑evident packaging and dual US data centers; ceremonies run twice a year with seven crypto officers per site and 3 required to activate a KSK, deposit boxes with dual locks, scripted checks and live streaming. KSK rollovers happen (2010, 2018), recovery uses five‑of‑seven encrypted shares, pandemic contingencies include couriered keys and signing longer‑lived ZSKs; current coverage is about 1371 of 1498 TLDs signed.

AI-written summary · about

" chapters (14)

1. 0:00Intro
2. 0:30Welcome
3. 1:20Domain name system
4. 4:10DNS
5. 6:30DNSSEC
6. 8:30DNSSEC Authentication
7. 9:40DNSSEC Security
8. 11:10Trusted Community Representatives
9. 22:05Roles
10. 27:05Pandemic
11. 29:35Safe intervention
12. 31:35Signing a response
13. 33:35Current statistics
14. 35:15Questions

" related talks

• 19mSecuring DNSSEC with Ritual and CeremonySmiljana Antonijevic · BSidesSF 2018
• 01h 27mDNS at 30Jim Hague · ACCU 2017
• 27mNo Keys? No Problem: Why You Can Trust Sigstore SignaturesFredrik Skogman, Joshua Lock, Asra Ali · SigstoreCon North America 2022
• 17mWhose Sign Is It Anyway?Marina Moore, Matthew Riley · SupplyChainSecurityCon North America 2021
• 33mDemystify Modern Signing: Keys, Certs, and EnvelopesJohn Kjell · CloudNativeSecurityCon North America 2024
• 46mDNSSECChristoph Egger · FrOSCon 2016
• 24mHSM Advances Supporting quantum-safe PKI AutomationOlivier Couillard · Post-Quantum Cryptography Conference 2025
• 27mA Longitudinal, End-to-End View of the DNSSEC EcosystemBalakrishnan Chandrasekaran, Bruce M. Maggs, Dave Levin, Taejoong Chung, Roland van Rijswijk-Deij, David R. Choffnes, Alan Mislove, Christo Wilson · 26th USENIX Security Symposium (USENIX Security '17)