- itar-announce - lists.icann.org

ITAR now closed
by Kim Davies Feb. 3, 2011

Feb. 3, 2011

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear colleagues, The Interim Trust Anchor Repository is now closed. Since the beginning of 2009, ICANN has operated a service known as the Interim Trust Anchor Repository (ITAR). This allowed top-level domain operators who use DNSSEC to publish their trust anchor in absence of a signed DNS root zone. On 15 July 2010, the DNS root zone was signed, and in the following months TLD operators have transitioned to using it. With the last remaining TLDs transitioning to the signed root zone, the ITAR is no longer required. The service was a successful bottom-up collaboration with the Internet community. ICANN was asked to operate the service to help DNSSEC adoption during its initial phases. During its lifetime, the ITAR supported over a hundred listing requests for dozens of top-level domains that were early adopters of DNSSEC. The operational experience ICANN gained in operating ITAR also helped inform the roll-out of the signed DNS root zone. Existing listings were removed on 18 November 2010, and the website was completely decommissioned on 28 January 2011. This is anticipated to be the last announcement sent to this mailing list. Thanks for your interest in our service. With kindest regards, Kim Davies Manager, Root Zone Services ICANN -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin) iD4DBQFNSzDm3AePosm0KEgRApMsAJ9J/aHqPLwI1wjLIGjtJlQhvxnVqACXXG1H x44tJh50zJMI4RjXNeMgaA== =bp3N -----END PGP SIGNATURE-----

1 0

End of Life Notice for ITAR
by Kim Davies Nov. 4, 2010

Nov. 4, 2010

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear colleagues, The Interim Trust Anchor Repository is now being retired from service. Starting today, no new listings will be accepted by the service. Later this month, existing listings will be removed; with the entire service turned off early next year. *** If you are using the ITAR service, please discontinue using it as soon *** *** as possible. We recommend you transition to using the signed DNS root *** *** zone. *** Since the beginning of 2009, ICANN has operated a service known as the Interim Trust Anchor Repository (ITAR). This allowed top-level domain operators who use DNSSEC to publish their trust anchor in absence of a signed DNS root zone. On 15 July 2010, the DNS root zone was signed, and in the following months TLD operators have transitioned to using it. With the last remaining TLDs transitioning to the signed root zone, the ITAR is no longer required. The service was a successful bottom-up collaboration with the Internet community. ICANN was asked to operate the service to help DNSSEC adoption during its initial phases. During its lifetime, the ITAR supported over a hundred listing requests for dozens of top-level domains that were early adopters of DNSSEC. The operational experience ICANN gained in operating ITAR also helped inform the roll-out of the signed DNS root zone. The expected date for existing listings to be removed is 18 November 2010, with the service fully retired in January 2011. These dates are subject to adjustment based on operational requirements or community feedback. With kindest regards, Kim Davies Manager, Root Zone Services ICANN -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin) iD8DBQFM0wYI3AePosm0KEgRAugNAJ4sYhWQYtn1KPu23l/+j+2mi+BdgQCgjJJE emWN8FBhL+h0SdfvPcJOjA0= =8ww7 -----END PGP SIGNATURE-----

1 0

RSA/SHA-256 records in ITAR; Improvements to anchors2keys
by Kim Davies March 29, 2010

March 29, 2010

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear colleagues, Last week, a top-level domain (.ARPA) was published in the Interim Trust Anchor Repository with the RSA/SHA-256 key algorithm. This is the first time this algorithm, published last October as RFC 5702, has been used by a TLD. Users of the ITAR should bear this in mind, particularly with respect to support of this algorithm in your validators. We've also recently made some updated to the "anchors2keys" script, based on requests from users: * Ability to add a header to the output with the "--header" command line argument. * Imports the SHA256 function from PyCrypto if you have it installed. SHA256 functions were built-in to Python from version 2.5 onward, so this helps support older installations. The revised version of the script is available at https://itar.iana.org/_misc/anchors2keys Finally, if you aren't aware, efforts to sign the DNS root zone proper are well underway. We have stated that ITAR is a limited-term project, due to be decommissioned once the root zone is signed. The current proposed timeline would see the root zone signing completed in July 2010. Our current intention is to consult with the community after that date on the future of ITAR. More information on the root zone singing project is at: http://www.root-dnssec.org/ With kindest regards, Kim Davies Manager, Root Zone Services ICANN -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin) iD8DBQFLsPem3AePosm0KEgRAo7wAJ0fP7jPV4uFqe8MLbk4p7hh/MGedwCfVr9A 44uriwjLyCIpSFYZE64XfU8= =FrT2 -----END PGP SIGNATURE-----

1 0

NSEC3 record in ITAR; --skip-nsec3 added to anchors2keys
by Kim Davies March 13, 2009

March 13, 2009

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear colleagues, Some of you have already noticed that the Interim Trust Anchor Repository listed its first trust anchor for an NSEC3 signed zone. The anchor, for .GOV, was added on Thursday. Those who do not have NSEC3 support in their validating resolvers may have trouble importing this trust anchor. To help you in this scenario, we have added some additional functionality to the "anchors2keys" tools available from the ITAR website. You can now invoke this script with a "--skip-nsec3" command line option and it will not generate the DNSKEY records for the zones signed with NSEC3. Note well, this means you can not validate these zones that are skipped as there will be no trust anchor listed. The revised version of the script is available at https://itar.iana.org/_misc/anchors2keys With kindest regards, Kim Davies Internet Assigned Numbers Authority -----BEGIN PGP SIGNATURE----- Version: 9.9.1.287 wj8DBQFJupfM3AePosm0KEgRAifoAJ0bN+fc3rNPWV+WtYZOIAdy8JcnRACg1N2j vdHLasOpDzF5iaM3jiFULqg= =Txq8 -----END PGP SIGNATURE-----

1 0