October 2014 - ksk-rollover

[ksk-change] tools for ksk rollover
by Benno Overeinder Oct. 16, 2014

Oct. 16, 2014

Related to the discussion in the room wrt. tools for implementation of Joe's draft. unbound-anchor implements that draft from Joe and includes an ICANN certificate with which it validates. See http://unbound.net/documentation/unbound-anchor.html and http://www.unbound.net/documentation/howto_anchor.html. Cheers, -- Benno -- Benno J. Overeinder NLnet Labs http://www.nlnetlabs.nl/

2 1

[ksk-change] Write up of key rollover experience
by Geoff Huston Oct. 16, 2014

Oct. 16, 2014

http://www.potaroo.net/ispcol/2010-02/rollover.html This is a writeup of the consequences of key rollover at the time when the in-addr zone operate with an unsigned root and without 5011 support. (Obviously a signed root has largely addressed this situation.) At the time there was a degree of reliance of various forms of out of band key distribution, which may have some relevance to the root key roll. Anyway, in response to a request for write ups of previous key roll experience, this is one. Geoff

1 0

[ksk-change] Promoting remote participation in today's ICANN 51 workshop
by Dan York Oct. 16, 2014

Oct. 16, 2014

FYI, to help potentially promote more remote participation in today's public workshop, I put out the following post this morning: http://www.internetsociety.org/deploy360/blog/2014/10/root-dnssec-ksk-rollo… (with a shortened URL of http://wp.me/p4eijv-5lj <http://wp.me/p4eijv-5lj> ) Feel free to pass that link along to anyone you know who might be interested. Please note that while the page on the ICANN 51 site *has* been updated - http://la51.icann.org/en/schedule/thu-dnssec-key-rollover - it now lists the times as 9:30-13:30. The plan as far as I know it is still to start at 9:00am after the SSAC Public Meeting ends and aim to finish up by noon. We do, though, have the room until 13:30 if we wish to continue discussions. Talk to many of you soon, Dan -- Dan York Senior Content Strategist, Internet Society york(a)isoc.org<mailto:york@isoc.org> +1-802-735-1624 Jabber: york(a)jabber.isoc.org<mailto:york@jabber.isoc.org> Skype: danyork http://twitter.com/danyork http://www.internetsociety.org/deploy360/

2 1

[ksk-change] Agenda and timeline for Root KSK Public Workshop on Thursday at ICANN 51
by Dan York Oct. 15, 2014

Oct. 15, 2014

List members, On behalf of the ad hoc program committee[1], I want to relay some information about the Root KSK Public Workshop on Thursday, October 16, 2014 here at ICANN 51 in L.A. LOCATION and TIME --------------------------------- The meeting will be on Thursday, October 16, 2014, from 9:00am - 12:00noon PDT (UTC-7). It will NOT be 0800-1800 as currently shown on the ICANN calendar. Location is the Brentwood Room on the lower California level. REMOTE PARTICIPATION --------------------------------- Remote participation information at: http://la51.icann.org/en/schedule/thu-dnssec-key-rollover AGENDA --------------------------------- The public workshop is aimed to be a discussion forum to collect guidance from a wide range of people. I have been asked to act as a moderator to ensure that the flow moves appropriately and that all get to contribute. The proposed agenda is: 1. INTRODUCTION A brief level setting of why the workshop has been called, where we are at in the process (ICANN public consultation in early 2013, SSAC report, ICANN Board resolution in Nov 2013), and what we hope to do in the workshop. (See my recent "Background Information" post [2] for links for more info.) 2. HOW a Root KSK Rollover might occur We would like to discuss how an automated (RFC5011 [3] ) would occur as well as non-5011 roll options and options for a staggered roll. Joe Abley will discuss a couple of relevant Internet Drafts. 3. WHAT a Root KSK Rollover might involve We would like to discuss what changes might be made during a Root KSK Rollover. Specifically two points: a. ALGORITHM CHANGE - Geoff Huston will give a presentation about potential impacts of a change of the algorithm. (Geoff also presented this information about the DNS-OARC meeting this past weekend.) b. Length of KSK - There has been some discussion about changing the length of ZSKs and KSKs and moving to longer key sizes. We would like a discussion around this idea and the potential impacts. 4. IMPLICATIONS Discussion of additional implications beyond those discussed earlier. For instance, issues around response sizes. 5. POTENTIAL TIMELINE (unanchored) We would like to discuss what a potential timeline might look like for the entire process. The intent is NOT to establish a fixed date but rather to establish what a timeline might look like for the full process to take place. 6. NEXT STEPS We want to spend the end of the session identifying specific steps and actions that will occur coming out of this workshop. Given that we only have three hours and a great amount to cover we will be asking people to assist us in helping keep the discussions focused and flowing and moving along through the agenda. Please feel free to send comments to the list - and we will see you on Thursday. Thank you, Dan [1] Ad hoc program committee: Joe Abley, Duane Wessels, Roy Arends, Jakob Schlyter, Dan York, David Conrad [2] http://www.internetsociety.org/deploy360/blog/2014/10/background-informatio… [3] http://tools.ietf.org/html/rfc5011 -- Dan York Senior Content Strategist, Internet Society york(a)isoc.org<mailto:york@isoc.org> +1-802-735-1624 Jabber: york(a)jabber.isoc.org<mailto:york@jabber.isoc.org> Skype: danyork http://twitter.com/danyork http://www.internetsociety.org/deploy360/

1 0

[ksk-change] Excerpt from a Gemalto bulletin
by Michael StJohns Oct. 14, 2014

Oct. 14, 2014

Gemalto (smart card vendor) is picking up Safenet the HSM vendor. Mike - > > > *Gemalto to acquire SafeNet, the worldwide leader in data and > software protection* > > > > SafeNet will significantly reinforce Gemalto's Identity and Access > Management business. It will become part of Gemalto's Payment & > Identity segment, and its Platforms & Services activity, that account > respectively for 1,329 million and 715 million of the 2013 pro forma > revenue. > *Press Release* >

3 2

[ksk-change] Testing new keys added
by Paul Hoffman Oct. 13, 2014

Oct. 13, 2014

Greetings again. Pure conjecture below. Assuming that a rollover uses the Double-KSK method described previously, is there an intention to test systems for the new SEP key before removing the old one? That is, if A is the current KSK and IANA adds B, after the 30-day hold-down time, either key could be used to sign zones in the root. One thought is to sign a test TLD "dywnagrebo" with just B, have an IANA-supported server that is authoritative for dywnagrebo, and include URLs such as www.test.dywnagrebo in some environments where they might be resolved. I'm not sure how one might be able to see when a lookup fails due to validation (as compared to failing due to it being a new TLD), so this could be a useless idea. However, more creative people here might be able to design a way to actually test that the B KSK is widely loaded before A is removed. --Paul Hoffman

5 10

[ksk-change] Which style of rollover were people thinking of?
by Paul Hoffman Oct. 7, 2014

Oct. 7, 2014

Greetings again. Assuming that we are still thinking of doing a KSK rollover, what style of rollover were people thinking of? draft-ietf-dnsop-dnssec-key-timing-05 describes described three. Of course, there is no DS record here, but the DS's moral equivalent is the manually trusted key(s) in the validating resolvers. --Paul Hoffman

4 4

Re: [ksk-change] FIPS-140 levels
by S Moonesamy Oct. 7, 2014

Oct. 7, 2014

Hi Tomofumi, At 15:37 06-10-2014, Tomofumi Okubo wrote: >Yes, that's right but that is if the other security controls >successfully detects the compromise. >The mechanism on the HSM will be the last line of defense if the other >security controls fail for some reason. This is why in the ICANN >definition, HSM is labelled as Tier 7. The HSM is currently at Tier 6. If I recall correctly I commented about that previously. I suggested a change a few months ago. I am waiting for feedback about the suggestion. Regards, S. Moonesamy

2 1

[ksk-change] Keeping two KSK keys long term
by Paul Hoffman Oct. 6, 2014

Oct. 6, 2014

Greetings again. It is my impression that having two (or more) KSK keys long term makes 5011 rollovers a bit less problematic, but I could be misunderstanding some of the subtleties of 5011 when mixed with draft-ietf-dnsop-dnssec-key-timing. If it is better, I would propose that the timing of the KSK change be "add second and third key, wait a bit, remove current (first) key" over "add a second key, wait a bit, remove the current (first) key, wait a bit, add a new key (so we have two)". Thoughts? --Paul Hoffman

9 50

[ksk-change] 2 weeks until the ICANN 51 workshop - logistics?
by Dan York Oct. 6, 2014

Oct. 6, 2014

Folks, To get a wee bit tactical, I'd like to point out that the public KSK Rollover Workshop is happening 2 weeks from TODAY on Oct 16. We now have a room (Brentwood) and a page on the ICANN website: http://la51.icann.org/en/schedule/thu-dnssec-key-rollover You'll note that the page says the time is from 08:00-18:00 ... that is the time DRC says we have the room for... but even as hard-core as so many of you are, I highly doubt that many of us want to meet for *10 hours* on this topic. So... step 1... WHEN do we want to hold the workshop? If you look at the rest of the schedule for Thursday: http://la51.icann.org/en/schedule?date=2014-10-16 you will see that SSAC has its public meeting from 08:00-09:00 and then all the other meetings pretty much end by 12:00 or 13:00 so that attendees can go to the Public Forum starting at 13:30 and going until 17:00. Leaving aside the question of what we will actually be discussing (let's kick off another thread on that), from a purely logistical point of view it seems to me that given that a number of people involved with KSK Rollover work are also in SSAC, we probably can't start until 9:00am. Also, if our goal is to attract many of the other attendees, we probably need to end before the Public Forum. Which, to me, means it seems like we have 09:00-12:00 or 12:30 if we want to leave time for people to get some lunch before the Public Forum. Agree? Disagree? Think we should go longer? Really want to spend 10 hours in the same room as the people on this list? Discuss....... :-) Dan -- Dan York Senior Content Strategist, Internet Society york(a)isoc.org<mailto:york@isoc.org> +1-802-735-1624 Jabber: york(a)jabber.isoc.org<mailto:york@jabber.isoc.org> Skype: danyork http://twitter.com/danyork http://www.internetsociety.org/deploy360/

3 2