- comments-ksk-rollover-restart-01feb18@icann.org

[Comments-ksk-rollover-restart-01feb18] Ratified: ALAC Statement on the Plan to Restart the Root Key Signing Key (KSK) Rollover Process
by ICANN At-Large Staff April 10, 2018

April 10, 2018

Dear All, Please find attached the ratified ALAC Statement on the Plan to Restart the Root Key Signing Key (KSK) Rollover Process<https://community.icann.org/display/alacpolicydev/At-Large+Workspace%3A+Pla…>. Content of the statement is unchanged. Ratification information has been included on the cover page. Kind Regards, ICANN Policy Staff in support of the At-Large Community E-mail: staff(a)atlarge.icann.org<mailto:staff@atlarge.icann.org> Website: atlarge.icann.org<http://atlarge.icann.org/> Facebook: facebook.com/icannatlarge<http://www.facebook.com/icannatlarge> Twitter: @ICANNAtLarge<http://www.twitter.com/ICANNAtLarge> [ignature_75470664]

1 0

[Comments-ksk-rollover-restart-01feb18] RrSG response to Plan to Restart the Root Key Signing Key (KSK) Rollover Process
by Zoe Bonython April 3, 2018

April 3, 2018

Hello, On behalf of the Registrar Stakeholder Group (RrSG) I would like to submit the comment below on the Plan to Restart the Root Key Signing Key (KSK) Rollover Process. Kind regards, Zoe Bonython RrSG Secretariat __________________________________________________________________ The RrSG would like to stress the importance of everyone involved in the operation of the DNS being fully prepared for the rollover. Having a secure and stable DNS is at the core of ICANN’s mission and of huge priority and importance to the RrSG. As the providers of domains and related services, both the clients and the business of registrars will of course be significantly impacted if the rollover results in domains or entire TLDs ceasing to function. With these priorities in mind we applaud ICANN’s previous decision to postpone the rollover and efforts to further study the likely impacts. While we are not inherently opposed to the rollover going forward on the currently proposed date of October 11, 2018, we would like to raise some concerns, recommendations, and questions that we believe should be before the rollover occurs. First, while the efforts undertaken to date to study why some validating recursive resolvers were not ready for the root KSK rollover are undoubtedly valuable, the actual findings were largely inconclusive and the proposed approach to proceed as planned given the paucity of information raises some concerns. ICANN should take time leading up to the scheduled rollover to undertake further study and preparation and consider whether further avenues of research are available that would improve preparedness. ICANN org’s stated intent to 'publicise the new date and attempt to get more validating resolver operators ready for the rollover’ is equally important and should be done with maximum effort to ensure the DNS does remain both secure and stable. The RrSG believes ICANN org should provide further information on exactly how and when they will be reaching out to DNS operators, so that the community can help fill any gaps that may exist either in the process or the parties who need to be engaged with. Lastly, beyond providing a summary of the additional efforts since the delay of the rollover, ICANN should publish a comprehensive, updated project plan to make clear to the community whether there are any modifications to the originally proposed schedule and set of contingency plans as a result of the additional study. The updated plan as well as comments from the current period could form the basis for a discussion with affected parties about the tradeoffs between moving forward accepting current risk and delaying the rollover to improve understanding and mitigation. A successful KSK rollover is critical to ensuring continued trust in the DNS. ICANN and the community should proceed with care to ensure that robust efforts to prepare for the rollover and notify affected operators are completed before moving forward with the timeline.

1 0

[Comments-ksk-rollover-restart-01feb18] NCSG Comment on KSK Rollover Process
by Rafik Dammak April 2, 2018

April 2, 2018

Hi, please find attached the NCSG comment on Plan to Restart the Root Key Signing Key (KSK) Rollover Process. Best Regards, Rafik Dammak

1 0

[Comments-ksk-rollover-restart-01feb18] Please proceed with this plan
by Phil Regnauld April 2, 2018

April 2, 2018

It's unlikely that more analysis will produce useful additional data - or that waiting will make the few percent, thought to be impacted by the rollover, do anything about it. Diminishing returns, etc.. There's too much to lose in terms of operational experience and credibility if we don't roll. Phil Regnauld Network Startup Resource Center

1 0

[Comments-ksk-rollover-restart-01feb18] Business Constituency (BC) comment on Plan to Restart the Root Key Signing Key (KSK) Rollover
by Steve DelBianco April 2, 2018

April 2, 2018

Attached is the comment of the ICANN Business Constituency (BC) regarding the draft Plan to Restart the Root Key Signing Key (KSK) Rollover Process. This comment was drafted by Denise Michel and Stephanie Duchesneau. It was approved in accord with the BC Charter. Steve DelBianco Vice Chair for Policy Coordination ICANN Business Constituency<http://bizconst.org/>

1 0

[Comments-ksk-rollover-restart-01feb18] Handy Networks Comment on the KSK Rollover Process
by Jay Sudowski - Handy Networks LLC April 2, 2018

April 2, 2018

I submit this comment in my professional capacity as the CEO of Handy Networks, LLC – a cloud hosting and data center based company with customers from 40+ countries. The proposed plan states: "Even after a concerted effort, ICANN org could often not determine which resolvers sent the message (such as when the resolver had a dynamic address), so there was no way to determine how many users would be affected by the rollover or why those resolvers had not updated their trust anchors. Additionally, even when ICANN org could identify the specific resolver, efforts to contact the operator were often unsuccessful." Given that the outreach efforts have been “often unsuccessful,” I ask OCTO to provide more details regarding the number and methods of contact that have been used to engage operators of potentially misconfigured DNS resolvers. I also ask that ICANN share some insight into their decision making process around why certain methods of outreach were excluded, given the importance of this issue. I also have done a quick analysis on a set of data provided by ICANN from February 1 – February 8, 2018 concerning potentially misconfigured DNS resolvers. I was able to draw the following observations: * 50% of misconfigured resolvers live in just 25 ASNs, * The top 2 ASNs represent 22% of misconfigured resolvers, * 1900 of 2300 ASNs with misconfigured resolvers have less than 9 hosts that are improperly configured. This analysis indicates that ICANN should adopt a more comprehensive outreach strategy, relative to the criticality of certain ASNs. Specifically, ICANN should consider adopting more comprehensive outreach methods to reach misconfigured DNS resolver operators, utilizing a combindation of direct manual outreach to the ASNs with the highest density of issues, indirect outreach through RIRs, ISCO, NOGs, and automated outreach efforts to operators using WHOIS and rWHOIS data that is publically availabile. Furthermore, ICANN should embrace the data it is in possession of and create a publically available status page that provides aggregate metrics and trending about the number of potentially misconfigured DNS resolvers. Additionally, ICANN should also consider creating a web service that network operators could interact with to get detailed information about potentially misconfigured hosts on their networks. ----- Jay Sudowski // Handy Networks LLC // Co-Founder & CEO Providing Dedicated Server, IaaS and Colocation Hosting Solutions Tel: 303-414-6902 | Cell: 720-544-1485 | Fax: 303-414-6912 www.handynetworks.com<http://t.sidekickopen04.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJN7t5XZsQ…>

1 0

[Comments-ksk-rollover-restart-01feb18] please proceed
by Evan Hunt April 2, 2018

April 2, 2018

I am in favor of the plan to roll the root KSK on 11 October 2018. It doesn't seem likely to me that the risks of doing so will decrease with a longer wait - rather more likely the opposite. We may as well tear off the band-aid quickly, and apply lessons learned to the next key roll. -- Evan Hunt -- each(a)isc.org Internet Systems Consortium, Inc.

1 0

[Comments-ksk-rollover-restart-01feb18] just do it!
by Jim Reid April 2, 2018

April 2, 2018

ICANN has taken all reasonable and prudent measures to mitigate the potential hazards that might arise from rolling the root key-signing key. It is hard to envisage what more could or should be done. The plan for continuing the rollover is fine. Unless compelling evidence to support another postponement emerges before a final decision is taken, the proposed rollover plan should be put into effect. It is highly unlikely that anything significant will break because a small number of validating resolvers seem to have been hard-wired with the current (and soon to be obsoleted) key. In any event, these misconfigured systems cannot be allowed to indefinitely delay the rollover. If they did, a rollover of the root's key-signing key will never happen because there would always be something somewhere which was unable to handle the new key. Or had been intentionally configured to properly handle a ket rollover. It is also important for Secure DNS (as well as the broader security and stability of the Internet) that rollover of the root key-signing key takes place. This is good cryptographic practice. Rolling the key has to take place from time to time. One day it might be necessary to carry out an emergency rollover -- say because a key or algoritim is considered compromised. It would obviously be better to have had some actual experience from planned rollovers before an emergency, forced rollover is needed regardeless of how unlikely that scenario might be.

1 0

[Comments-ksk-rollover-restart-01feb18] Ratification Pending: ALAC Statement on the Plan to Restart the Root Key Signing Key (KSK) Rollover Process
by ICANN At-Large Staff April 2, 2018

April 2, 2018

Dear All, Please find attached the ALAC Statement on the Plan to Restart the Root Key Signing Key (KSK) Rollover Process. In the interest of time, the ALAC Chair requested that the Statement be transmitted to the ICANN public comment process with a note that the Statement is pending ALAC ratification. ICANN Policy Staff in support of the At-Large Community E-mail: staff(a)atlarge.icann.org<mailto:staff@atlarge.icann.org> Website: atlarge.icann.org<http://atlarge.icann.org/> Facebook: facebook.com/icannatlarge<http://www.facebook.com/icannatlarge> Twitter: @ICANNAtLarge<http://www.twitter.com/ICANNAtLarge> [ignature_624952760]

1 0

[Comments-ksk-rollover-restart-01feb18] Internet Society comments on plan to roll the Root KSK on 11 October 2018
by Dan York April 2, 2018

April 2, 2018

We support the "ksk-rollover-restart" plan and urge ICANN to proceed with the Root KSK Rollover on 11 October 2018. As we stated in our comments in 2013 [ https://forum.icann.org/lists/comments-root-zone-consultation-08mar13/msg00… ], we believe that this rollover of the Root KSK is critical to ensure the ongoing operational reliability of DNSSEC. We do understand and appreciate the concerns that caused the postponement from the original target date of 11 October 2017. While the deployment of RFC 8145 gave some insight into potential failure, it is not clear what the actual impact of a rollover is going to be. It is also not clear whether in a relatively short timescale - on the order of a year or less - the risk assessment will be better informed. That, with the continued risk of further ossification of the existing trust anchor, makes us continue to support an 'early rollover scenario'. We encourage ICANN and associated partners to continue further study of the RFC 8145 data to better understand the risks - but we believe that the plan should still move forward. We also encourage ICANN to continue to expand communication and outreach activities to help the community of network operators be prepared to address any issues on 11 October 2018. We will do what we can to assist in this communication and outreach - and encourage all others involved with DNSSEC to do what they can as well. We look forward to the successful Root KSK Rollover on 11 October 2018 - and to what lessons can be learned so that Root KSK Rollovers can potentially occur on a more regular basis. Regards, Olaf Kolkman, Chief Internet Technology Officer. Dan York, DNSSEC Program Coordinator Internet Society https://www.internetsociety.org/

1 0