<div dir="ltr">Just wondering, have you asked if 3 of the TCR's might be willing to actually come? With enough protections, would that be possible?<br clear="all"><div><div dir="ltr" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><br>-- <br>Bob Harold</div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Mar 30, 2020 at 3:19 PM Warren Kumari <<a href="mailto:warren@kumari.net" target="_blank">warren@kumari.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Fri, Mar 27, 2020 at 5:46 AM Erwin Lansing via dns-operations<br>
<<a href="mailto:dns-operations@dns-oarc.net" target="_blank">dns-operations@dns-oarc.net</a>> wrote:<br>
><br>
><br>
><br>
><br>
> ---------- Forwarded message ----------<br>
> From: Erwin Lansing <<a href="mailto:erwin@lansing.dk" target="_blank">erwin@lansing.dk</a>><br>
> To: Kim Davies <<a href="mailto:kim.davies@iana.org" target="_blank">kim.davies@iana.org</a>><br>
> Cc: Sergey Myasoedov <<a href="mailto:s@netartgroup.com" target="_blank">s@netartgroup.com</a>>, "<a href="mailto:dns-operations@dns-oarc.net" target="_blank">dns-operations@dns-oarc.net</a>" <<a href="mailto:dns-operations@dns-oarc.net" target="_blank">dns-operations@dns-oarc.net</a>><br>
> Bcc:<br>
> Date: Fri, 27 Mar 2020 10:34:51 +0100<br>
> Subject: Re: [dns-operations] [Ext] Re: Contingency plans for the next Root KSK Ceremony<br>
> Hi Kim,<br>
><br>
> > On 27 Mar 2020, at 01.55, Kim Davies <<a href="mailto:kim.davies@iana.org" target="_blank">kim.davies@iana.org</a>> wrote:<br>
> ><br>
> > Hopefully our approach does not depend solely on TCRs for confidence.<br>
> > We've consciously sought to operate a highly transparent process<br>
> > that allows anyone who is interested - not just TCRs - to witness<br>
> > proceedings and be involved, either in person or remotely. Further,<br>
> > we are audited by a third-party audit firm using the SOC 3 framework<br>
> > (formerly SysTrust), and have received unqualified opinions each year<br>
> > since we first started in 2010: <a href="https://www.iana.org/about/audits" rel="noreferrer" target="_blank">https://www.iana.org/about/audits</a><br>
> ><br>
> > Another key protection is we seek to disseminate all the relevant<br>
> > materials from the ceremony. All audit footage, software used, and<br>
> > the logs and artefacts generated are posted online for download and<br>
> > inspection.<br>
> ><br>
> > Certainly if there is a perception that trust hinges critically on TCRs,<br>
> > we've either not communicated the breadth of the controls well enough,<br>
> > or we need to do more to instill trust. Just as the security envelope<br>
> > for the KSK involves multiple overlapping physical security controls,<br>
> > maintaining trust in KSK management should involve multiple overlapping<br>
> > trust mechanisms to satisfy the community.<br>
><br>
> I think you hit the nail on the head here: it’s all about perception.<br>
<br>
Yup - just like a bank (or currency), the primary concern is the<br>
perception of trust. For the sake of argument, let's pretend I don't<br>
trust Kim et al at all / have some agenda to call the security /<br>
stability of DNSSEC into question.<br>
<br>
So, the safes get drilled; on camera and with all of TCRs (and their<br>
aunties) watching. Everyone watches the ceremony, and everyone agrees<br>
that everything went perfectly and there were no shenanigans -- what<br>
happens *after* the ceremony?<br>
How can we prove that nothing bad occurred after the ceremony<br>
concluded and the cameras were turned off? I'm assuming that new locks<br>
will be installed, and materials returned to their rightful places,<br>
but this still leaves Kim et al with a big pile-o-keys that they could<br>
use. We could probably stick (on camera) numbered tamper evident seals<br>
over the locks, and have Kim sign them, but now we have devolved the<br>
security to just numbered stickers / numbered bags and the signature<br>
of the same person/people who have the pile-o-keys.<br>
<br>
Before people get all up in arms, no, I'm not suggesting that IANA is<br>
actually going to sneak in after the cameras are turned off and<br>
<insert movie plot scenario here>, and I also recognize that these are<br>
exceptional circumstances - what I'm trying to do is figure out how we<br>
accomplish this while maintaining the actual and *perceived* trust in<br>
the system -- it would be very sad if a few months from now we realize<br>
that there was something really simple that we could have done to<br>
maintain the trustworthiness, but didn't think of... The IANA and TCRs<br>
have invested heavily in maintaining the trust in the system - I'd<br>
hate to see that lost because we didn't think of something we could<br>
have (easily) done...<br>
<br>
We also need to ensure that we don't end up too much in the tin foil<br>
hat camp, but I don't think I've seen any discussion of what happens<br>
after the ceremony and think it would be useful to try and cover the<br>
re-securing phase (of course, it is entirely possible I missed it...)<br>
<br>
W<br>
<br>
> No matter how many other controls and layer of security, drilling a safe bring up certain images in peoples minds. For that reason alone, I’d also rather avoid that solution, but extraordinary circumstances require extraordinary solutions. As you say, the process is a transparent as it can be, and with enough emphasis on the existing, and possibly extra, security measures, it should be no problem to dispel that perception, and it may well be the most practical way to go.<br>
><br>
> Best,<br>
> Erwin<br>
><br>
><br>
><br>
> ---------- Forwarded message ----------<br>
> From: Erwin Lansing via dns-operations <<a href="mailto:dns-operations@dns-oarc.net" target="_blank">dns-operations@dns-oarc.net</a>><br>
> To: Kim Davies <<a href="mailto:kim.davies@iana.org" target="_blank">kim.davies@iana.org</a>><br>
> Cc: "<a href="mailto:dns-operations@dns-oarc.net" target="_blank">dns-operations@dns-oarc.net</a>" <<a href="mailto:dns-operations@dns-oarc.net" target="_blank">dns-operations@dns-oarc.net</a>><br>
> Bcc:<br>
> Date: Fri, 27 Mar 2020 10:34:51 +0100<br>
> Subject: Re: [dns-operations] [Ext] Re: Contingency plans for the next Root KSK Ceremony<br>
> _______________________________________________<br>
> dns-operations mailing list<br>
> <a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.net</a><br>
> <a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
<br>
<br>
<br>
-- <br>
I don't think the execution is relevant when it was obviously a bad<br>
idea in the first place.<br>
This is like putting rabid weasels in your pants, and later expressing<br>
regret at having chosen those particular rabid weasels and that pair<br>
of pants.<br>
---maf<br>
<br>
_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
</blockquote></div>