The Internets Master Key Just Changed

Author: Better Stack · Watch on YouTube

Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.

Original language: English

Original video: The Internets Master Key Just Changed · Channel: Better Stack · 05:54 · Watch on YouTube

Topics: Cybersecurity and software security, AI infrastructure and hardware

Summary

The video explains how DNS works, how its lack of built-in authentication enabled cache-poisoning attacks, and how DNSSEC uses signatures to verify DNS data. At the top of DNSSEC’s chain of trust is a master key whose secret half is kept in a secure facility and used only to sign the root’s list of keys. The video describes the security procedures used to create and activate a replacement key, including the requirement for three of seven crypto officers to unlock the machine. It also notes that DNSSEC protection depends on both websites signing their records and resolvers checking them, and suggests updating a router or system if it retained the old master key.

Key points

DNS translates website names into IP addresses, but original DNS did not verify that answers came from the genuine server.
An attacker could flood a resolver with fake answers, guessing the IDs used to match replies, and potentially poison its cache.
DNSSEC adds signatures that allow resolvers to check whether DNS answers are authentic.
The DNSSEC chain of trust reaches the root, whose secret key is kept in a secure room in Virginia.
The root master key signs only the root’s own list of keys and is brought out of the vault a few times a year.
The root switched from the 2017 master key to the 2024 key on October 11; the new key is identified in the transcript as 38696.
Three of seven crypto officers must plug in their security keys before the machine can create a key.
The key ceremony uses multiple security layers, a laptop without a hard drive or battery, and a read-only operating system.
The transcript says about 5% of .com names are signed and about 41% of internet users use a resolver that checks DNSSEC.
If a resolver still holds the old master key, updating the router or system can make it pick up the new one.

Chapters

Start	Chapter	Summary
00:00	DNS and the cache-poisoning problem	The video introduces the root key and explains how attackers could exploit DNS’s lack of answer verification.
02:11	How DNSSEC and the root key work	It describes DNSSEC’s chain of trust, the root key’s role, and the switch to the new master key.
03:14	Inside the key ceremony	The video walks through the secure facility, the officers’ security keys, and the process for generating the new key.
05:18	Who is protected and what to do	It explains the adoption figures cited for DNSSEC and recommends updating a router or system if it still has the old key.

Quotes

nobody can ever know its value. — 00:00

The ID is the only thing that the resolver checks — 01:08

The long-term fix for this is DNSSEC — 02:11

The machine won’t do anything until three of those seven security keys have been plugged into it. — 04:16

Only about 5% of .com names are signed — 05:18

Concepts and entities

DNS, DNSSEC, resolver, root servers, crypto officers, ICANN, Better Stack

Full transcript (original language)

00:00 In a locked room in Virginia, a key was created that keeps the internet running around the world, but for it to work, nobody can ever know its value. On Sunday, that key was switched and for some people the internet just stopped working. The machine that holds it only unlocks when three of its seven key holders plug in their own security key, and each of those USB keys is kept in its own locked deposit box. So, in this video, we’ll cover what this key does every time you open a website and the ceremony where three crypto officers create new keys in a highly secure room.

00:36 When you visit a web address, your computer can’t connect to its name. It needs its IP address. So, it goes to a resolver, usually your router, your internet service provider, or a public one like Google’s 8888, and asks for that IP address. They send your request out to different servers to find the answer. This system is called DNS. The problem is that the original DNS had no proof built in. The resolver may be asking lots of questions at once, so it tags each one with a random ID, and the server copies that ID back into its

01:08 answer. The ID is the only thing that the resolver checks, and nothing proves that the answer actually came from the real server. An attacker starts by making your resolver ask a question. That’s easy because they can just send it a lookup for the site they want to fake. And if the resolver doesn’t already know the answer, it goes off and asks the real server. Now, there’s a short gap before the real answer comes back. In that gap, the attacker sends a flood of fake answers that claim to come from the real server, each one guessing a different ID. They can’t see the real IDs, but there are only around 65,000 of

01:40 them. So, on average, about 32,000 guesses will likely get you a hit. If one of those guesses matches before the real answer arrives, your resolver accepts it, remembers it, and hands it to everyone else who asks. You end up on a malicious website, and the address bar still says the right name. People had known about this for years, then in 2008 a security researcher showed how to combine a few of these weaknesses, and the official advisory called the results extremely effective. DNS software all over the internet had to be patched. The

02:11 long-term fix for this is DNSSEC, and it had already been written back in 2005. So, it works like this. Each signer has a key with two halves, a secret half that makes a signature and a public half that anyone can use to check if the signature is real. When your resolver looks up an IP address, it goes through a chain. Say we visit example.com. First, it asks the root servers which point it to the .com servers, which point it to example.com’s own server. Each step vouches for the key of the next, but nobody sits above

02:41 the root, so its key is handled differently. The public half is copied into every resolver that checks signatures, and the secret half is the one in the locked room in Virginia. That’s why nobody can ever know its value. However, how would the secret half could sign fake answers that every one of those resolvers would trust? So, it only signs one thing, the root’s own list of keys, and it only comes out the vault a few times a year. The master key does get replaced, and on Sunday, the 11th of October, the root switched from the 2017 key to the 2024 one. You can

03:14 see this for yourself. If you ask the root for its keys right now, you get the old master key and the new one, plus the everyday key they sign. The signature at the bottom was made by the new key, number 3 I 696, and it starts on the 11th of October. And just a quick note from our sponsor, guys, which is actually me. If you enjoy videos like this and want to see more, then subscribe to Better Stack and we can keep releasing free content every single day. So, how is this key actually made? It happens inside a building in Culpeper, I think I’m saying that right, inside Virginia, and the key sits seven

03:45 layers deep. There are three layers of security just to reach the ceremony room itself, then a cage that you can only get into from that room. Then safes inside the cage and the machine that holds the key is locked inside one of those safes. And nobody’s ever allowed alone in there because two staff have to stay inside the ceremony room whenever anyone else is inside. The people who unlock the machine are called crypto officers. They come from the wider internet community from countries like Sweden, Zimbabwe, Chile, Sri Lanka, and none of them are allowed to work for

04:16 ICANN. Each one has a key to their own safe deposit box and inside is a USB key sealed with a tamper evident bag. The machine won’t do anything until three of those seven security keys have been plugged into it. On the 26th of April 2024, they made the new key live on stream with three cameras recording. First, they boot up a laptop that has no hard drive and no battery from a read-only copy of its operating system. Then the room checks it’s the right system by reading its fingerprint out loud as a list of words while half of them follow along on the big screen.

04:47 Then the three crypto officers’ keys go in one after the other and then someone types in a single command. The machine creates the key from its own randomness in about half a second and prints the new key’s number 38696. The secret half never leaves that machine except as an encrypted backup. Everyone then signs a paper script and it all goes up online. And it actually doesn’t always go smoothly either. In 2020, one of the ceremonies had to be completely postponed because they couldn’t open one of the safes. For you to be protected by the system, the website you visit has to sign its

05:18 records and your resolver has to also check them. Only about 5% of .com names are signed and about 41% of internet users sit behind a resolver that actually checks. So if your internet just suddenly stopped working around the 11th of October this year, your resolver might have still been holding the old master key and the fix is just to update your router or system so it picks up the new one. And if you enjoy videos like this, then subscribe to see more and you can check out this next video.

05:54 >> Mhm.