January 2018 - ksk-rollover

Re: [ksk-rollover] 答复: Architectural reconsideration on ICANN's Root Zone KSK rollover
by Robert Story Feb. 26, 2018

Feb. 26, 2018

On Wed 2018-01-31 10:55:53+0800 Davey wrote: > So I'm inspired that it is not necessary for additional set of root > server and coordination between server and resolver > for this purpose. All the work can be done in server side. This is true. > It can be implemented on server side with "two logic views"(similar > but different from BIND multiple view mechanism. > When authoritative server recognize the resolvers who support RFC5011 > (via rfc8145 or combined with kskroll-sentinel), > it can roll the key only for them. Roll KSK not once for all but > per-resolver. In that case there is no need any modification on > resolver. Root server operator should do this work only. So there is > no interoperability problem. No specification of DNS is > needed which shorten the time and concerns. There is still risk in this. Many end users are behind NATs. This means that some queries from an IP can signal that it is using the new key, while others could signal it is not. Instead of making this some sort of automatic process, it could be entirely opt-in if root-servers configured views based on destination address and simply listened on an additional anycast address. But this still leaves the problem of how to advertise the new address, and wouldn't deal with the problem of resolvers which switched to the new address even though they weren't configured to trust the new keys. If we could convince the resolver implementations to ship with multiple hints files, and to selected on at startup based on configured trust anchors, we could see the traffic shift are resolvers were updated. -- Robert Story <http://www.isi.edu/~rstory> USC Information Sciences Institute <http://www.isi.edu/>

4 4

Architectural reconsideration on ICANN's Root Zone KSK rollover
by Davey Song(宋林健) Jan. 31, 2018

Jan. 31, 2018

Hi folks, I followed the discussion in this ML and composed a draft proposal (attached and in my repo) as an input. I will not proceed in IETF but consider to publish it in other form, if you think it is too radical to implement. Any comments on the proposal or edits for my poooor English is welcome. J The link of my repo: https://github.com/songlinjian/Parallel-Root-KSK-Rollover Best regards, Davey

2 2

Starting discussion on acceptable criteria for proceeding with the root KSK roll
by Paul Hoffman Jan. 17, 2018

Jan. 17, 2018

Greetings in the new year. As announced on this list (and in many other places) a few weeks ago, the ICANN org wants to use this list to get input from the community on acceptable criteria for proceeding with the root KSK roll. When we made that announcement, we saw a good number of new subscriptions to the list, but the discussion didn't start on its own, so we want to get that going. For reference, please see <https://www.icann.org/news/blog/update-on-the-root-ksk-rollover-project>. The relevant timing part from that article is: > The ICANN org will monitor this mailing list and beginning on 15 January 2018, we will develop a draft plan for proceeding with the root KSK roll based on the input received and discussion on the mailing list. The plan will be published by 31 January 2018 and undergo a formal ICANN public comment process to gather further input. We would really like to hear from you about the criteria you think would be relevant for us to observe/measure, if such criteria exist. --Paul Hoffman

19 42

Re: [ksk-rollover] Starting discussion on acceptable criteria for proceeding with the root KSK roll
by S Moonesamy Jan. 14, 2018

Jan. 14, 2018

Hi Geoff, At 04:19 PM 04-01-2018, Geoff Huston wrote: >Carlos, (I'm asking because you posted a "me >too") what is the data set you are using to >justify this call to be "over soon"? It seems >to me that in the absence of new data, the only >changed factor is your own appetite for risk. >Without additional data, your tolerance for risk >appears to increase over time (*). But is this >altered personal perception of the risk >sufficient motivation to proceed? Objectively, >if the numbers in September 2017 gave sufficient >grounds to pause, and the numbers haven't >changed (**) then surely the grounds for pausing >the operation as as strong now as they were in September (***). There is the following in the KSK rollover plan: "The Design Team is unaware of what specific objectives would be achieved by delaying a KSK roll". The plan was put on hold because of the data from September 2017. At the moment it is unknown if/when there will be a KSK roll. Is not doing a KSK roll by 2020 [1] a viable option? Regards, S. Moonesamy 1. The date is based on a statement in the DPS.

12 19