DNSSEC Practice Statement for the Root Zone KSK Operator

en · official · sha256:dea4af3069c0003af24d69214e9543cda3417ca1475f0db1a37b0f19b6c70292

The RZ KSK Operator's signer systems are protected by a minimum of four tiers of physical security, with access to lower tiers required before gaining access to higher tiers. Progressively more restrictive physical access controls to each tier are applied. Unauthorized access becomes increasingly difficult as one reaches higher tiers.¶

Referencing norms: PhysicalTier

en · official · sha256:d1a98cfaf5b27d3013907b1896780f1f6dffdd52358a20f2a6e83ba8ce2e0b5b

Trusted roles include, but are not limited to:¶ System Administrators¶ Crypto Officers¶ Recovery Key Share Holders¶ Safe Security Controllers¶ Internal Witnesses¶ Ceremony Administrators¶ 4.2.2. Number of Persons Required per Task The RZ KSK Operator has established, maintains, and enforces rigorous control procedures to ensure the segregation of duties based on roles and to ensure that multiple Trusted Persons are required to perform sensitive tasks.¶ The most sensitive tasks, such as access to and management of cryptographic key material, are enforced by rigorous control procedures to ensure the segregation of duties based on roles. These

Referencing norms: Ceremony, CeremonyAdministrator, CryptoOfficer, InternalWitness, Person, RecoveryKeyShareHolder, SafeSecurityController, crypto_officer_present, recovery_share_holder_present

en · official · sha256:714bf6356432c0f9fed680b5c5eb88fc9297ed431b53c76971eab2f34741928a

Any RRSIG record generated as a result of a KSK signing operation will not have a validity period longer than 21 days, and will never expire more than 180 days in the future.¶ Disaster recovery procedures may override the standard RRSIG expiration period if reasonable concerns exist regarding the ability to conduct subsequent key signing operations during their allotted window. Additional RRSIG records may be generated further in advance of the standard validity period, which would remain in the possession of the RZ KSK Operator until the time in which all RRSIG records in the set would not expire more than 180 days in the future. The RZ KSK Operator will withhold RRSIG records generated for future validity periods using methods which reasonably safeguard the confidentiality, integrity, and availability of the RRSIG records utilizing a KMF and an offsite storage facility until they are transmitted to the RZ ZSK

Referencing norms: MaxRrsigFutureExpiryDays/value/urn%3Aicann%3Aclir%3Aksk-ceremony%3Aparam%3Amax-rrsig-future-expiry-days%23dps-8/definition, MaxRrsigValidityDays/value/urn%3Aicann%3Aclir%3Aksk-ceremony%3Aparam%3Amax-rrsig-validity-days%23dps-8/definition, RrsigWindowWithinFutureExpiryLimit, RrsigWindowWithinValidityLimit, SignatureWindow, rrsig_future_expiry_days, rrsig_validity_days, rrsig_window, signature_window_allowed

en · official · sha256:679814a7cafdd81ea596f8378aad9814ec5b5d6d27eabd1dfe1c404cfdc8d52c

two of the Safe Security Controller #1s, and one out of the two Safe Security Controller #2s in addition to the Trusted Persons required at Tier 5 and 7.¶ Tier 7: Activation of an HSM requires three out of seven Crypto Officers to extract activation material from above safe deposit boxes using their physical key. Safe deposit box operation that involves opening of any one of the deposit box requires three out of seven Crypto Officers to be present.¶ Restoration of the contents of an HSM requires several trusted persons from multiple roles, as follows:¶ Storage Master Key (SMK): Reconstruction of the SMK used for encryption of the application keys requires five out of seven Recovery Key Share Holders.¶ Domain Key: Reconstruction of the domain key used for secure key transfer between HSMs and partitions, requires five out of seven Recovery Key Share Holders or Crypto Officers.¶ Encrypted Application Keys: Physical access to the encrypted application keys requires one person from the Ceremony Administrators role, one person from the Internal Witness role, and one of two Safe Security Controller #1s.¶ These combinations of people are designed so that the binomial probability to find a group collaborating in any of these constellations is less than one in a million, assuming a dishonesty rate of 5% among Trusted Persons¶ Other internal control procedures are designed to ensure that at a minimum of two Trusted Persons are required to perform any

Referencing norms: HsmActivation, RecoveryThreshold, SigningQuorum, hsm_activated, recovery_threshold_met, signing_quorum_met

en · official · sha256:1448dd88f7dcdb633b2cf9b41eb51ea8d0ea13f6b57c01ce33f7a63d9f2bb0f7

4.5.4.1. Variances In the event of a declaration of a disaster recovery or business continuity response, the adverse event may necessitate variances to the procedural controls and technical security controls. These variances shall be limited in scope to those necessary for the successful conduct of key signing operations, and according to protocols that best ensures a proper record of the chain-of-custody and limiting sensitive operations to trusted persons. The RZ KSK Operator shall ensure such variances are consented by the RZ KSK Operator's management, are documented and communicated.¶

Referencing norms: DisasterVarianceEffective, HsmActivationUnderDisasterVariance, Management, SafeCompletionUnderDisasterVariance, disaster_recovery_declared, disaster_variance_effective, variance_consented_by_management, variance_consented_by_management/external, variance_recorded_and_communicated