KSK Key Signing Ceremony (16 Jun 10)
Why Hacker News recommends it
HN cites it to show how seriously root key ceremonies are secured and to let people watch one.
What it is
Highlights of the June 2010 ICANN DNSSEC root Key Signing Ceremony, showing the procedures used to generate and protect the root zone signing key.
Recommended by 0 HN commenters across 0 different months, 2013 to 2014.
What Hacker News said
Cites MacsHeadroom · 2013-06 · on “PRISM update”
Not very likely. CA Certificate generation is about as secure as the papal election (read one of the most secure proceedings in existence). See [this video]
Cites jackweirdy · 2013-09 · on “Let’s Take Back The Certificate Authority”
Well we have a hell of a lot more transparency about where that key is, who generated and has access to it. There's a video of the entire ceremony online somewhere, at the moment I can only find [this summary]( [this video] )
Cites news_embargo · 2014-05 · on “Fedora 21 To Have DNSSEC Validation Enabled By Default”
I thought your first comment was just grumbling, but this comment suggests some misunderstanding. The root zsk is split over a group (Shamir share) held by mostly non-US key holders. (One from the US is Dan Kaminsky, whose work and my user name has special relevancy for you. You'd agree he's not part of the US government.) I believe all the key holders are trustworthy, and if any were not, you'd need a majority (5 of the 7) to subvert the zsk. So an xkcd-wrench-style attack on the key by governments would require implausible circumstances. The key ceremony is video taped and can be watched: [this video] Other TLDs (some being countries) also hold key signing ceremonies and video tape them. You ca