It’s Hard To Change The Keys To The Internet And It Involves Destroying HSM’s

This post details the operational challenges and realities of rolling the root DNS zone's Key Signing Key (KSK) using the RFC5011 mechanism. It explains the states of cryptographic keys (Generated, Published, Active, Retired, Revoked), the difference between the root KSK and Zone Signing Key (ZSK), and the trust anchor mechanism for the root zone. The post highlights the postponement of the KSK rollover in 2017 due to issues with RFC5011 implementation adoption by validating resolvers, particularly with BIND-9. It discusses the operational complexities of resolvers maintaining state and persistent storage, and identifies failure modes in RFC5011 implementations. The post also touches upon the potential for switching to different cryptographic algorithms like elliptic curves in the future.