High-tech Low-tech security fail

[wylk]

An interesting security "fail" occurred last week (Feb 14 2020). This not Antique in any way but it might entertain the group.

A critical part of the Internet is DNS, Domain Name Service, and a secure DNS (DNSSEC) is being deployed which relies on signed cryptographic certificates. The security of the cryptographic keys is very important and the Key Signing Key (KSK) is kept in a building in a locked cage inside two safes. Once every three months a key signing "ceremony" is held to sign new certificates and a very detailed protocol is followed which includes opening the safes.

Before the ceremony starts, some checks are made, including a test opening of the safes. One of the safes would not open! The ceremony was canceled and a locksmith was called to drill the safe (or hopefully do some other work first, like use a soft-blow hammer). I haven't found anything more so far about what went wrong other than it was, in fact, drilled. Video is supposed to be posted later.

KSK ceremonies are live-streamed and put on Youtube to demonstrate transparency, integrity, and so on. Here is the recent one: https://www.youtube.com/watch?v=B46cWBUU2l4

It's not very interesting except I did skip to the safe openings. At 14:15 or so they start to unlock the cage which seems to need more than one person. At 15:25 they start to open one of the safes which requires a single person. And so on.

Here's a screen grab of Safe 2 open with Safe 1 in view:



Some random observations --

The locks all seem to be electronic, the safe locks are dial type such as Kaba Mas X-10 or S&G 2740B. In no case was there any apparent attempt to check audit logs, such as the number of successful openings and/or unsuccessful openings.

If they had asked me, I might have suggested two different safes from different makers with different locks.

I generally don't like electronic locks but in this case it might be OK because of the audit log, but only if they check the audit log.

Video from the previous ceremony in their other facility shows their locks are X-10 (based on the color). The safes appear to be bolted to the floor using some sort of strap. I'd rather see them bolted down from the inside.



Does anybody recognize the safes? In both facilities there is an apparent magnetic sensor, lower-left on the front door and frame.