[Opendnssec-user] ods-signerd calling vmstat?!?

[Rick van Rein (OpenFortress)]

Hi all,

>> I'm still not convinced these are harmless. But I guess I'm strongly
>> biased to only depending on a FIPS certified RNG.

What I read here is that uncertainty is causing fear and doubt.  It is hard to resist paranoia in the field of cryptography, but knowledge is a much better guide than relocating unfounded fears in a standard that may or may not meet your requirements.  Fear, uncertainty and doubt are not a technical line of reasoning, and it is not necessary since the field of cryptography lends itself to analysis and reasoning.

Before you decide to embrace or even request any kind of certification approach, I would advise identifying your security requirements, how they are met with FIPS, and how they are *not* met in other ways.  As soon as your requirements are crystal clear, you will probably find that the current setup is good enough if SoftHSM is good enough; and more likely, that a commerciel HSM product is better suited.  If that leads to a disparity between technical requirements and available funds you may have to realign these factors.

Software cannot create entropy out of thin air, especially if we start doubting every concrete implementation.  Entropy is simple to be had, but only when using hardware.  It's a bit of a craft, really… http://openfortress.org/cryptodoc/random

> I think we need to think about where OpenDNSSEC will be used the most,
> which is our target audience.

OpenDNSSEC is not the issue here -- as Rickard already stated, it shifts any problems with cryptographic implementations to the other end of the PKCS #11 interface.  This is reasonable, as it is what PKCS #11 was designed for.

> FIPS-like requirements are great if you are a TLD, or a large DNS host
> with many zones. If you are a small shop signing only a couple of zones,
> then it's too much.

Disagreed.  FIPS-like requirements are great if you need what it brings you.  It is totally independent on your size, but merely coincides with the importance that you attach to the security of your zones.

> It would be great if different target audiences could be defined at run
> time, but I don't know if it's doable.

This is why OpenDNSSEC lets you choose an HSM that meets your security requirements.

I hope this is helpful, even if it does not reflect full agreement.

Cheers,

Rick van Rein
OpenFortress Digital signatures