November 2014 - ksk-rollover

[ksk-change] Action #3 - Root KSK Rollover Workshop at ICANN 52
by Dan York Jan. 20, 2015

Jan. 20, 2015

Action #3 - We decided to hold another workshop at ICANN 52 in Marrakesh. We asked for volunteers to be part of a "program committee" to organize the activities for ICANN 52. The following people indicated their interest at today's meeting in being involved: Participants: David Conrad, Geoff Huston, Jacques Latour, Joe Abley, Paul Ebersman, Dan York Q FOR LIST: Who else would be willing to participate in planning the ICANN 52 activities? (Please reply to list) Two notes: - We did not identify a lead for the program committee but I would assume DRC would be the point person (unless he says otherwise). - We did not discuss whether we want to have a public workshop AND a closed "interop" workshop as we did this time. This is something that we as a group may want to decide. (Discuss.... :-) ) Regards, Dan -- Dan York Senior Content Strategist, Internet Society york(a)isoc.org<mailto:york@isoc.org> +1-802-735-1624 Jabber: york(a)jabber.isoc.org<mailto:york@jabber.isoc.org> Skype: danyork http://twitter.com/danyork http://www.internetsociety.org/deploy360/

5 7

[ksk-change] Action #2 - Creation of a document about multiple Root KSKs and a rollover
by Dan York Nov. 20, 2014

Nov. 20, 2014

Action #2 - We agreed that we need to create a document that outlines items such as (and this is NOT a complete list): - How could it work to have multiple Root KSKs? What would be involved? - What would be the logistics look like for a keyroll? - What are the concerns about rollback? Lead: David Conrad (DRC) said that he (or someone he finds) will take lead on this document. Participants: Mads, Kumar, Joe Several other people contacted me afterwards saying that they would be interested and need to figure out if they can with schedules, etc. (And now is the time they can say if they are in fact able to help with the document... ) Q FOR LIST: Who else would like to work on this document? Please reply back to the list. Regards, Dan -- Dan York Senior Content Strategist, Internet Society york(a)isoc.org<mailto:york@isoc.org> +1-802-735-1624 Jabber: york(a)jabber.isoc.org<mailto:york@jabber.isoc.org> Skype: danyork http://twitter.com/danyork http://www.internetsociety.org/deploy360/

4 4

[ksk-change] FYI: media coverage of '1024 DNSSEC RSA keys are weak'
by Richard Lamb Nov. 14, 2014

Nov. 14, 2014

Thanks to Peter Koch for pointing these articles out. -- Heise, a German language online news medium, published an article titled "DNSSEC with too short RSA keys". <http://www.heise.de/newsticker/meldung/DNSSEC-mit-zu-kurzen-RSA-Schluesseln -2449480.html> The article refers to a paper by Dan Bernstein and Tanja Lange about advances in factorization by massively parallel hardware operation <http://cr.yp.to/factorization/batchnfs-20141109.pdf>. It appears that the article might go far beyond the substance or even the claims in the paper. There was a previous note at <http://www.golem.de/news/verschluesselung-parallele-angriffe-auf-rsa-schlue ssel-mit-1-024-bit-1411-110435.html>, much less alarmist. Some serious review of the paper to evaluate the claims and conclusions would be helpful. -Peter PS: an obviously, if RSA1024 was unusable for DNSSEC, there are other uses ..

1 0