Root DNSSEC KSK Ceremony 40

en · official · sha256:0e1ef5154e645d7369b01712b1e1f9c732b5e4bda56194ca1e5e67e78c2d7e7f

Act 1: Initiate Ceremony and Retrieve Materials Act 1: Initiate Ceremony and Retrieve Materials The CA initiates the ceremony by performing the steps below: • • • • • Verify that the audit cameras are recording and the online video streaming is enabled Confirm that all of the ceremony attendees have signed in using the visitor log in Tier 3 Review emergency evacuation procedures Explain the use of personal devices and the purpose of this ceremony Verify the time and date so that all entries into the script follow a common time source At this point, the CA and IW will escort the SSCs and TCRs into Tier 5 (Safe Room) to retrieve the following materials: • Safe #1: HSM, laptop, OS DVD, etc • Safe #2: The TCRs' smartcards required to operate the HSM Sign into Tier 4 (Key Ceremony Room) Step 1 2 3 Activity Initials CA confirms with SA that all audit cameras are recording and online video streaming is enabled. CA confirms that all participants are signed into Tier 4 (Key Ceremony Room), then performs a roll call using the list of participants on page 2. CA asks that any first time ceremony participants introduce themselves. Time Emergency Evacuation Procedures and Electronics Policy Step 4 5 6 Activity Initials CA reviews the emergency evacuation procedure with onsite participants. CA explains the use of personal electronic devices during the ceremony. CA briefly explains the purpose of the ceremony. Time Verify the Time and Date Step 7 Activity Initials IW enters UTC date (year/month/day) and time using a reasonably accurate clock visible to all in Tier 4 (Key Ceremony Room): Time Date and time: All entries into this script or any logs should follow this common source of time. Page 5 of 38 Act 1: Initiate Ceremony and Retrieve Materials Open Safe #2 (Tier 6, Credentials Safe) 8 9 10 Activity Initials CA and IW transport a flashlight, and escort SSC2 and the COs into Tier 5 (Safe Room.) SSC2 opens Safe #2 while shielding the combination from the camera. Time Note: SSC will begin by rapidly spinning the dial counter-clockwise in order to charge it. Perform the following steps to complete the safe log: a) SSC2 removes the existing safe log, then shows the most recent page to the audit camera. b) IW provides the pre-printed safe log to SSC2. c) SSC2 writes the date and time, then signs the safe log where "Open Safe" is indicated. d) IW verifies the entry then initials it. Page 6 of 38 Act 1: Initiate Ceremony and Retrieve Materials COs Extract the Credentials from Safe Deposit Boxes (Tier 7) Activity Initials COs perform the following steps sequentially to retrieve the required TEBs: a) With the assistance of the CA (and the common key), the CO opens their safe deposit box. Time Note: Common Key is for the bottom lock. CO Key is for the top lock. b) CO reads aloud the safe deposit box number, verifies its integrity, then removes the OP TEB and SO TEB. c) CO reads aloud the TEB numbers, then verifies their integrity while showing them to the audit camera above. d) CO retains the TEB(s) specified below, then locks the safe deposit box. Note: The CO's key will remain inserted in their safe deposit box lock when specified below. e) CO writes the date and time, then signs the safe log where removal of a TEB is indicated. f) IW verifies the completed safe log entries, then initials it. CO1: Arbogast Fabian Box # 1791 (Key shall remain in lock) OP TEB # BB46584376 (Retain) SO TEB # BB46584377 (Retain) 11 CO2: Dmitry Burkov Box # 1793 (Key shall remain in lock) OP TEB # BB46584378 (Retain) SO TEB # BB46584379 (Retain) CO3: João Damas Box # 1071 (Key shall remain in lock) OP TEB # BB46592091 (Retain) SO TEB # BB46584455 (Retain) CO4: Carlos Martinez Box # 1068 (Key shall remain in lock) OP TEB # BB46592092 (Retain) SO TEB # BB46584665 (Retain) CO6: Nicolas Antoniello Box # 1073 (Key shall remain in lock) OP TEB # BB46584382 (Retain) SO TEB # BB46584383 (Retain) CO7: Subramanian Moonesamy Box # 1792 OP TEB # BB46584384 (Retain) SO TEB # BB46584385 (Retain) Close Safe #2 (Tier 6, Credentials Safe) Step 12 13 14 Activity Initials Once all safe deposit boxes are closed and locked, SSC2 writes the date and time, then signs the safe log where "Close Safe" is indicated. IW verifies the entry then initials it. SSC2 returns the safe log to Safe #2, closes the safe door, pulls up on the handle, and ensures it's locked by spinning the dial at least two full revolutions each way, counter-clockwise then clockwise. CA and IW verify that the safe is locked and the "WAIT" light indicator is off. CA, IW, SSC2, and COs leave Tier 5 (Safe Room) with TEBs, returning to Tier 4 (Key Ceremony Room). Page 7 of 38 Act 1: Initiate Ceremony and Retrieve Materials Open Safe #1 (Tier 6, Equipment Safe) Activity 15 CA and IW transport a cart, and escort SSC1 to Tier 5 (Safe Room.) 16 SSC1 opens Safe #1 while shielding the combination from the camera. Initials Time Note: SSC will begin by rapidly spinning the dial counter-clockwise in order to charge it. 17 Perform the following steps to complete the safe log:

Referencing norms: AccessCompletion, Ceremony, RootKskCeremony, RootKskCeremony/Accessed, RootKskCeremony/ActivateHsm, RootKskCeremony/Attest, RootKskCeremony/Attested, RootKskCeremony/GrantAccess, RootKskCeremony/HsmActive, RootKskCeremony/MaterialsReturned, RootKskCeremony/OpenSafes, RootKskCeremony/ReturnMaterials, RootKskCeremony/SafesOpened, RootKskCeremony/Scheduled, RootKskCeremony/SignKsr, RootKskCeremony/SkrChecked, RootKskCeremony/SkrSigned, RootKskCeremony/VerifySkr, RootKskCeremonyState, RootKskCeremonyStep, RootKskCeremonyTransition, SafeCompletion, SafeCompletionUnderDisasterVariance, access_completed, access_observed, attempted_transition, ceremony_administrator_present, ceremony_recorded, current_state, entered_state, initial_state, internal_witness_present, left_state, procedure_instance, safe_controller_present, safes_completed, safes_opened_observed, state_before, valid_transition

en · official · sha256:df33f138b57b8230c6378c8faf5f0057bc5a902609ec3243a6ffc3f6d5130ea5

Act 3: Activate HSM (Tier 7) and Generate Signatures Act 3: Activate HSM (Tier 7) and Generate Signatures Using the ksrsigner application the CA takes the Key Signing Requests (KSRs) and generates the Signed Key Responses (SKRs) by performing the steps below. • • • • • The CA activates the HSM using the TCRs' smartcards After connectivity is confirmed the flash drive containing the KSRs is inserted into the laptop The ksrsigner application uses the private key stored in the HSM to generate the SKR Note: The SKR contains the digital signatures of the ZSK slated to be used in the next quarter The CA then prints the signer log, backs up the newly created SKR, and deactivates the HSM TCR Credentials Check Step Activity Initials The CA calls each of the COs listed below sequentially to perform the following steps: a) CO reads aloud the TEB number, then CA inspects it for tamper evidence. b) CO and CA open the TEB, then the CA removes the plastic case containing the card(s). c) CA opens the plastic case, then places the card(s) within on the designated card holder at the front of the ceremony table. CA retains the plastic case on the ceremony table. Time CO1: Arbogast Fabian OP TEB # BB46584376 SO TEB # BB46584377 1 CO2: Dmitry Burkov OP TEB # BB46584378 SO TEB # BB46584379 CO3: João Damas OP TEB # BB46592091 SO TEB # BB46584455 CO4: Carlos Martinez OP TEB # BB46592092 SO TEB # BB46584665 CO6: Nicolas Antoniello OP TEB # BB46584382 SO TEB # BB46584383 CO7: Subramanian Moonesamy OP TEB # BB46584384 SO TEB # BB46584385 Page 13 of 38 Act 3: Activate HSM (Tier 7) and Generate Signatures Enable/Activate the HSM (Tier 7) 2 Activity CA performs the following steps to activate the HSM: a) Utilize the HSM’s keyboard to scroll through the menu using < > b) Select "1.Set Online", press ENT to confirm. c) When "Set Online?" is displayed, press ENT to confirm. d) When "Insert Card OP #X?" is displayed, insert the OP card. e) When "PIN?" is displayed, enter "11223344", then press ENT. f) When "Remove Card?" is displayed, remove the OP card. g) Repeat steps d) to f) for the 2nd and 3rd OP cards. Initials Time Confirm the "READY" LED on the HSM is ON. IW records which cards were used below. Each card is returned to its designated card holder after use. 1st OP card ____ of 7 2nd OP card ____ of 7 3rd OP card ____ of 7 Note: If the card is unreadable, gently wipe its metal contacts and try again. Check the Network Connectivity Between Laptop and HSM Step 3 4 Activity Initials CA connects the HSM to the laptop using an ethernet cable in the LAN ports. CA performs the following steps to test the network connectivity between laptop and HSM: a) Use the Commands terminal window b) Test connectivity by executing: ping hsm[6] c) Wait for responses, then exit by pressing: Ctrl + C Time Insert the KSR FD Step 5 Activity Initials CA plugs the FD labeled "KSR" then waits for it to be recognized by the OS. CA points out the KSR file that will be signed on each folder, then closes the file system window. Time Note: The KSR FD was transferred to the facility by the RKOS. It contains 1 KSR. Execute the KSR Signer for KSR 2020 Q2 Step 6 7 Activity Initials CA executes the command below on the terminal window to sign the KSR file: ksrsigner[7] /media/KSR/KSK40/ksr-root-2020-q2-0.xml When the KSR signer displays the prompt: Activate HSM prior to accepting in the affirmative!! (y/N): CA confirms that the HSM is online, then enters "y" to proceed. Page 14 of 38 Act 3: Activate HSM (Tier 7) and Generate Signatures Verify the KSR Hash for KSR 2020 Q2 8 Activity Initials When the hash of the KSR is displayed on the terminal window, perform the following: a) CA asks the Root Zone Maintainer (RZM) representative to identify themself in front of the room and provide documents for IW to review off camera for the purpose of authentication. b) IW retains the hash and PGP word list for KSR 2020 Q2, and employment verification letter provided by the RZM representative and writes their name on the following line: Time c) RZM representative reads aloud the PGP word list SHA-256 hash of the KSR file being used. 9 10 Participants confirm that the hash displayed on the terminal window matches with the RZM discourse, then CA asks "are there any objections?" CA enters "y" in response to "Is this correct (y/N)?" to complete the KSR signing operation. The SKR is located in: /media/KSR/KSK40/skr-root-2020-q2-0.xml Print Copies of the KSR Signer log Step 11 Activity Initials CA executes the commands below using the terminal window to print the KSR Signer log: a) lpadmin -p HP -o copies-default=X Time Note: Replace "X" with the amount of copies needed for the participants. b) printlog[8] ksrsigner-202002*.log 12 IW attaches a copy of the required ksrsigner log to their script. Back up the Newly Created SKR Step 13 14 Activity CA executes the following commands using the terminal window: a) List the contents of the KSR FD by executing: ls –ltrR /media/KSR b) Copy the contents of the KSR FD to the HSMFD by executing: cp –pR /media/KSR/* . Initials Time Note: Confirm overwrite by entering "y" if prompted. c) List the contents of the HSMFD to verify it has been copied successfully by executing: ls –ltrR d) Unmount the KSR FD by executing: umount /media/KSR CA removes the KSR FD containing the SKR files, then gives it to the RZM representative. Page 15 of 38 Act 3: Activate HSM (Tier 7) and Generate Signatures Disable/Deactivate the HSM (Tier 7) 15 Activity Initials CA utilizes the unused OP cards to deactivate the HSM:

Referencing norms: HsmActivation, HsmActivationUnderDisasterVariance, RootKskCeremony, RootKskCeremony/Accessed, RootKskCeremony/ActivateHsm, RootKskCeremony/Attest, RootKskCeremony/Attested, RootKskCeremony/GrantAccess, RootKskCeremony/HsmActive, RootKskCeremony/MaterialsReturned, RootKskCeremony/OpenSafes, RootKskCeremony/ReturnMaterials, RootKskCeremony/SafesOpened, RootKskCeremony/Scheduled, RootKskCeremony/SignKsr, RootKskCeremony/SkrChecked, RootKskCeremony/SkrSigned, RootKskCeremony/VerifySkr, RootKskCeremonyState, RootKskCeremonyStep, RootKskCeremonyTransition, SkrGeneration, attempted_transition, current_state, entered_state, hsm_activated, hsm_activation_observed, initial_state, left_state, procedure_instance, skr_generated, skr_generation_observed, state_before, valid_transition

en · official · sha256:b84c155e5036a20acdad88665487b7636a50a690a046c77b44f0a028b468ac01

IW makes a copy of their script for off-site audit bundle. Each Audit bundle contains: a) Output of signer system – HSMFD. b) Copy of IW’s key ceremony script. c) Audio-visual recording from the audit cameras. d) Logs from the Physical Access Control System and Intrusion Detection System: Range: 20190814 00:00:00 to 20200213 00:00:00 UTC e) IW's attestation (Appendix C). f) SA's attestation (Appendix D and E). Time All TEBs are labeled Root DNSSEC KSK Ceremony 40, dated and initialed by IW and CA. An off-site audit bundle is delivered to an off-site storage.

Referencing norms: AttestationCompletion, MaterialsReturn, RootKskCeremony, RootKskCeremony/Accessed, RootKskCeremony/ActivateHsm, RootKskCeremony/Attest, RootKskCeremony/Attested, RootKskCeremony/GrantAccess, RootKskCeremony/HsmActive, RootKskCeremony/MaterialsReturned, RootKskCeremony/OpenSafes, RootKskCeremony/ReturnMaterials, RootKskCeremony/SafesOpened, RootKskCeremony/Scheduled, RootKskCeremony/SignKsr, RootKskCeremony/SkrChecked, RootKskCeremony/SkrSigned, RootKskCeremony/VerifySkr, RootKskCeremonyState, RootKskCeremonyStep, RootKskCeremonyTransition, attempted_transition, attestations_completed, attestations_observed, current_state, entered_state, initial_state, left_state, materials_returned, materials_returned_observed, procedure_instance, state_before, valid_transition

en · official · sha256:8e936ad570667fdd421f15b0f5bcce2e57cdcc9cbfa7dba56b450b7bbb2ef45a

Unplanned events (exceptions) during the ceremony are evaluated, documented, and acted upon. It is the CA’s sole responsibility to decide on proper actions after consulting with the IW. In either case, an exception is regarded as an incident, and incident handling procedures are enacted.

Referencing norms: CeremonyException, CeremonyPosition, LoggedExceptionNeedsFinding, exception_logged, exception_requires_finding

en · official · sha256:e2e9232ba5f1ccc2b8c765842f801a472f7c3c36b4ae9333653f7cb0c99a6e2c

Act 3: Activate HSM (Tier 7) and Generate Signatures Verify the KSR Hash for KSR 2020 Q2 8 Activity Initials When the hash of the KSR is displayed on the terminal window, perform the following: a) CA asks the Root Zone Maintainer (RZM) representative to identify themself in front of the room and provide documents for IW to review off camera for the purpose of authentication. b) IW retains the hash and PGP word list for KSR 2020 Q2, and employment verification letter provided by the RZM representative and writes their name on the following line: Time c) RZM representative reads aloud the PGP word list SHA-256 hash of the KSR file being used. 9 10 Participants confirm that the hash displayed on the terminal window matches with the RZM discourse, then CA asks "are there any objections?" CA enters "y" in response to "Is this correct (y/N)?" to complete the KSR signing operation. The SKR is located in: /media/KSR/KSK40/skr-root-2020-q2-0.xml Print Copies of the KSR Signer log Step 11 Activity Initials CA executes the commands below using the terminal window to print the KSR Signer log: a) lpadmin -p HP -o copies-default=X Time Note: Replace "X" with the amount of copies needed for the participants. b) printlog[8] ksrsigner-202002*.log 12 IW attaches a copy of the required ksrsigner log to their script. Back up the Newly Created SKR Step 13 14 Activity CA executes the following commands using the terminal window: a) List the contents of the KSR FD by executing: ls –ltrR /media/KSR b) Copy the contents of the KSR FD to the HSMFD by executing: cp –pR /media/KSR/* . Initials Time Note: Confirm overwrite by entering "y" if prompted. c) List the contents of the HSMFD to verify it has been copied successfully by executing: ls –ltrR d) Unmount the KSR FD by executing: umount /media/KSR CA removes the KSR FD containing the SKR files, then gives it to the RZM representative. Page 15 of 38 Act 3: Activate HSM (Tier 7) and Generate Signatures Disable/Deactivate the HSM (Tier 7) 15 Activity Initials CA utilizes the unused OP cards to deactivate the HSM:

Referencing norms: RootKskCeremony, RootKskCeremony/Accessed, RootKskCeremony/ActivateHsm, RootKskCeremony/Attest, RootKskCeremony/Attested, RootKskCeremony/GrantAccess, RootKskCeremony/HsmActive, RootKskCeremony/MaterialsReturned, RootKskCeremony/OpenSafes, RootKskCeremony/ReturnMaterials, RootKskCeremony/SafesOpened, RootKskCeremony/Scheduled, RootKskCeremony/SignKsr, RootKskCeremony/SkrChecked, RootKskCeremony/SkrSigned, RootKskCeremony/VerifySkr, RootKskCeremonyState, RootKskCeremonyStep, RootKskCeremonyTransition, SkrVerification, attempted_transition, current_state, entered_state, initial_state, left_state, procedure_instance, skr_verification_observed, skr_verified, state_before, valid_transition