<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Hi Shane, I agree with the levels of HSM according with the level on the DNS tree.</div>But the chain breaks at it's weakest link.<div>DNSSEC is a chain, and a TLD manager probably don't want to be the weakest link.</div><div>Strength does not involve expensive technology, but rather involves doing things right.</div><div><br></div><div>If is possible to provide some model of low cost HSM to all levels of the chain, why not to implemented to provide strength to the chain.</div><div>A cheap smart card (FIPS aware) could be enough to many lower levels of the DNS tree, the key to deploy it massively could be simplified and automate procedures.</div><div>If is possible to fit all the key generation, storage and signing process within a usb device, could be an interesting solution.</div><div><br></div><div>Luis,</div><div><br><div><div>On Oct 16, 2012, at 10:05 AM, Shane Kerr <<a href="mailto:shane@isc.org">shane@isc.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Robert,<br><br>On Tuesday, 2012-10-16 14:52:09 +0200, <br>Robert Kisteleki <<a href="mailto:robert@ripe.net">robert@ripe.net</a>> wrote:<br><blockquote type="cite">Hi,<br><br>(Blowing the dust off of an old hat of mine...)<br><br><br>On 2012.10.16. 12:34, Shane Kerr wrote:<br><blockquote type="cite"><blockquote type="cite">i keep wondering about the use of hsms in dnssec and rpki<br>signing. i suspect that the threat model is not well thought out.<br></blockquote><br>The only attack that I could see an HSM protecting against is an<br>insider stealing the keys without being detected, like Alexander<br>mentioned. The idea is that a motivated attacker could in principle<br>make a copy of the keys - but not if they are stored in an HSM.<br></blockquote><br>The attacker's point is not to *steal* the key, but to *sign*<br>something with it; most likely a hash or such. If I can inject a<br>hash-to-be-signed into the to-be-signed queue, then I won, I don't<br>really care about the key itself. Sure, if I actually have a copy of<br>the key, then it's way easier :-) but as you say, HSMs can prevent<br>that.<br></blockquote><br>You describe a useful but less potent attack.<br><br>With DNS, if you publish a bogus zone file, it is straightforward for<br>the "real" owner of the zone data to detect the bad data, and then you<br>can do an emergency roll-over, publish a new zone, and Bob's your uncle.<br><br>However, a stolen key can be used to send bad data to a resolver<br>without the operators of the authoritative server ever knowing about<br>it, Kaminsky-style. They could do this presumably until you rolled your<br>key, which is probably several years away.<br><br>(A sufficiently sophisticated attack could in theory produce a signed<br>zone with bogus data, and then a signed zone without bogus data, and<br>somehow insure that only the "good" zone gets published, but that seems<br>unrealistic.)<br><br><blockquote type="cite"><blockquote type="cite">Also note that there are possible weaknesses with even an HSM,<br>depending on how backups are made. These can be worked around with<br>procedure and extra layers of security (cameras, access logs, ...).<br></blockquote><br>It's possible to come up with bad escrow mechanisms, which leave the<br>key vulnerable. That's just bad engineering, it's got nothing to do<br>with HSMs. However, a properly designed procedure with enough support<br>from the HSM will defend against this.<br></blockquote><br>I think this actually brings up what I consider a major problem with<br>the recommendation to use an HSM in general: unless you are going to<br>revise all of your entire security processes, it's a waste. And unless<br>there was something wrong with your security processes, then why should<br>you be forced to change them just because you are now using DNSSEC?<br><br>My take on HSM:<br><br> For ICANN: of course (and all the theater too!)<br><br> For TLD/banks/governments: if you feel that you must<br><br> For everyone else: don't bother<br><br>--<br>Shane<br>_______________________________________________<br>dns-operations mailing list<br><a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br>dns-jobs mailing list<br>https://lists.dns-oarc.net/mailman/listinfo/dns-jobs<br></blockquote></div><br><div apple-content-edited="true">
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; -webkit-text-decorations-in-effect: none; text-indent: 0px; -webkit-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; -webkit-text-decorations-in-effect: none; text-indent: 0px; -webkit-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><span class="Apple-style-span" style="border-collapse: separate; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; -webkit-text-decorations-in-effect: none; text-indent: 0px; -webkit-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">-- </div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Luis D. Espinoza</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Jefe TI - NIC Costa Rica</div></span></span></div></span></div></span></div></span></span><br class="Apple-interchange-newline"></span><span><img height="87" width="615" id="d435dd27-0651-48a0-9aaf-23b3a2a4aec9" apple-width="yes" apple-height="yes" src="cid:B91103EA-6422-407D-AB94-4DD81C490663"></span>
</div>
<br></div></body></html>