Trust is at the foundation of the eduGAIN service offered by GÉANT and in providing this service we look to build that trust in two ways: through technical trust and through behavioural trust. As such, we would like to invite you to take part in the upcoming eduGAIN Key Signing Ceremony. There will be a live-stream of the key signing ceremony on 8th March 2022 at 10:00 CEST. You can sign up for this here.
This will be an on premises HSM key signing ceremony, with trusted members of the eduGAIN team travelling to the SUNET offices to oversee the process.
What is a Key Signing Ceremony?
In distributed services such as eduGAIN, the flow of trust throughout operations is at the heart of the offering and is essential for the model to work. In a signing ceremony, a group of trusted people oversee the generation of a unique pair of public and private root keys that will safeguard the core infrastructure or root of the service. There is a well established process for the ceremony.
The ceremony builds both technical trust and behavioural trust. The technical trust is maintained via established key generation processes and the effective management of the public and private keys. Behavioural trust is (hopefully) gained through the transparency of the ceremony (publishing the process and streaming the event) and through the witnesses in the room. The result of the key generation process is the production of a small number of cryptographic private keys to be stored in secure environments where they will be used to sign the eduGAIN metadata. The corresponding public keys are to be published along with public records of the ceremony. For instance we will record the proceedings and make those video recordings available.
The ceremony does not stop when the cryptographic keys are generated but also ensures that key material is securely stored in multiple locations by trusted parties and that the public information (eg public keys) are published in a trustworthy manner
Why is this important for eduGAIN?
For eduGAIN, the generated keys will help protect the Metadata Distribution Service (MDS) which is described in the eduGAIN Metadata Aggregation Practice Statement. It is essential that eduGAIN members and their entities can trust this authoritative source of information for the services we access via eduGAIN. The structure is both simple (a secure, well managed aggregate of information) and critical – access to essential services can depend on this information being secure, available and correctly used.
The key signing ceremony is one of many ways in which we ensure that the eduGAIN service is trustworthy. It sits alongside other processes such as the eduGAIN Declaration and membership processes and the community oversight of the service to provide a unique trusted offering.
We look forward to seeing you on the 8th March.
