- ksk-rollover - lists.icann.org

(no subject)
by Axel BorgDuca3 Nov. 7, 2018

Nov. 7, 2018

Can You Please have new Digital Wifi? Sent from Mail for Windows 10 --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

problem report: couple broken Turris Omnia installations
by Petr Špaček Nov. 7, 2018

Nov. 7, 2018

Hello, here is anecdotal information about tiny problem caused by recent KSK rollover: Turris Omnia routers by CZ.NIC are shipped with DNSSEC validation enabled by default. KSK-2017 was distributed to Omnia installations using built-in automatic software updates months before the actual rollover. Yet we saw couple individual users reporting problems after the rollover and at the same time vast majority of users did not have any problem. Further investigation yielded nothing useful so I can only share list of possible explanations we came up with: - system restore close to rollover event using old configuration backup - messed up system upgrade Unfortunatelly there is no wisdom to share. -- Petr Špaček @ CZ.NIC

1 0

resolvers with KSK-2010 only working as forwarders
by Petr Špaček Nov. 7, 2018

Nov. 7, 2018

Hello, here is one more wild guess/attempt to explain KSK-2010 only resolvers: Some of resolvers which RFC8145-report having only KSK-2010 [1] might be used as forwarders in some larger DNS caching topology, e.g. inside a company networks. Recent versions of Knot Resolver and I believe also Unbound set CD (Checking Disabled) bit when forwarding queries to another resolver, so intermediary resolver with KSK-2010 only would not cause resolution failure on these "leaf" resolvers. I seriously doubt this can explain all of KSK-2010 only resolvers but it might be a contributing factor. [1] http://root-trust-anchor-reports.research.icann.org/ -- Petr Špaček @ CZ.NIC

1 0

The Recent KSK Rollover: Summary and Next Steps
by Paul Hoffman Oct. 31, 2018

Oct. 31, 2018

Here's a blog post from today that summarizes what we saw and what happens next. No one on this list needs to follow the suggestion in the last paragraph and subscribe a second time. :-) https://www.icann.org/news/blog/the-recent-ksk-rollover-summary-and-next-st… --Paul Hoffman

2 1

First Root KSK Rollover Successfully Completed
by Edward Lewis Oct. 19, 2018

Oct. 19, 2018

LOS ANGELES – 15 October 2018 – The Internet Corporation for Assigned Names and Numbers (ICANN) has determined that the first-ever changing of the cryptographic key that helps protect the Domain Name System (DNS) has been completed with minimal disruption of the global Internet. It was the first time the key has been changed since it was first put in use in 2010. After evaluation of the available data, there does not appear to be a significant number of Internet end-users who have been persistently and negatively impacted by the changing of the key. The few issues that have arisen appear to have been quickly mitigated and none suggested a systemic failure that would approach the threshold (as defined by the ICANN community) to initiate a reversal of the roll. In that context, it appears the rollover to the new Key Signing Key, known as KSK 2017, has been a success. At this point, there are no indications it is necessary to back out of the rollover and ICANN will now proceed to the next step in the rollover process: revoking the old KSK, known as KSK 2010 during the next key ceremony in the first quarter of 2019. "This successful exercise of the infrastructure necessary to roll the root zone's key has demonstrated it is possible to update the key globally," said David Conrad, ICANN's Chief Technology Officer. "It also provided important insights that will help us with future key rolls," The final decision to roll the root zone Key Signing Key (KSK) was made by ICANN President and CEO Göran Marby after reviewing the outcomes of the efforts of ICANN and others, particularly in the Domain Name System (DNS) technical community. These outcomes were the result of significant global outreach efforts, in consultation with the ICANN community, and after extensive analysis of available data. With the final approvals in place, ICANN implemented the 16 September 2018 resolution of ICANN's Board. The resolution stated that the organization should proceed with its revised plans to change or "roll" the key for the DNS root on 11 October 2018. To learn more about the Root KSK Rollover, visit its dedicated webpage and primary source of information: http://www.icann.org/kskroll About ICANN ICANN's mission is to help ensure a stable, secure, and unified global Internet. To reach another person on the Internet, you need to type an address – a name or a number – into your computer or other device. That address must be unique so computers know where to find each other. ICANN helps coordinate and support these unique identifiers across the world. ICANN was formed in 1998 as a not-for-profit public-benefit corporation with a community of participants from all over the world. https://www.icann.org/news/announcement-2018-10-15-en

13 15

Re: [ksk-rollover] 答复: First Root KSK Rollover Successfully Completed
by Edward Lewis Oct. 17, 2018

Oct. 17, 2018

In general, reason for any service outage would need explanation by the service provider. Service provisioning is so complicated (layers upon layers) that what's seen on the surface is hardly representative of what's inside. A rule from years of developing monitoring scripts: It's one thing to detect and measure symptoms, it's an entirely different thing to make a diagnosis. On 10/16/18, 11:50, "ksk-rollover on behalf of Davey Song(宋林健)" <ksk-rollover-bounces(a)icann.org on behalf of ljsong(a)biigroup.cn> wrote: I had several bounce mails today from my Gmail to IETF's mail. It's weird. The response from the remote server was: 550 5.7.1 mail w9G8HQ5a028992 from 2607:f8b0:4864:20::72a rejected by DCC The bounce may irrelevant with KSK. But an question came up to my mind that how can a user identify a failure caused by KSK rollover? Davey > -----邮件原件----- > 发件人: ksk-rollover [mailto:ksk-rollover-bounces@icann.org] 代表 Edward > Lewis > 发送时间: 2018年10月16日 0:08 > 收件人: ksk-rollover(a)icann.org > 主题: [ksk-rollover] First Root KSK Rollover Successfully Completed > > LOS ANGELES – 15 October 2018 – The Internet Corporation for Assigned > Names and Numbers (ICANN) has determined that the first-ever changing of > the cryptographic key that helps protect the Domain Name System (DNS) has > been completed with minimal disruption of the global Internet. It was the first > time the key has been changed since it was first put in use in 2010. > > After evaluation of the available data, there does not appear to be a significant > number of Internet end-users who have been persistently and negatively > impacted by the changing of the key. > > The few issues that have arisen appear to have been quickly mitigated and > none suggested a systemic failure that would approach the threshold (as > defined by the ICANN community) to initiate a reversal of the roll. In that > context, it appears the rollover to the new Key Signing Key, known as KSK 2017, > has been a success. > > At this point, there are no indications it is necessary to back out of the rollover > and ICANN will now proceed to the next step in the rollover process: revoking > the old KSK, known as KSK 2010 during the next key ceremony in the first > quarter of 2019. > > "This successful exercise of the infrastructure necessary to roll the root zone's > key has demonstrated it is possible to update the key globally," said David > Conrad, ICANN's Chief Technology Officer. "It also provided important insights > that will help us with future key rolls," > > The final decision to roll the root zone Key Signing Key (KSK) was made by > ICANN President and CEO Göran Marby after reviewing the outcomes of the > efforts of ICANN and others, particularly in the Domain Name System (DNS) > technical community. These outcomes were the result of significant global > outreach efforts, in consultation with the ICANN community, and after > extensive analysis of available data. > > With the final approvals in place, ICANN implemented the 16 September 2018 > resolution of ICANN's Board. The resolution stated that the organization should > proceed with its revised plans to change or "roll" the key for the DNS root on 11 > October 2018. > > To learn more about the Root KSK Rollover, visit its dedicated webpage and > primary source of information: https://urldefense.proofpoint.com/v2/url?u=http-3A__www.icann.org_kskroll&d… > > About ICANN > ICANN's mission is to help ensure a stable, secure, and unified global Internet. > To reach another person on the Internet, you need to type an address – a name > or a number – into your computer or other device. That address must be > unique so computers know where to find each other. ICANN helps coordinate > and support these unique identifiers across the world. ICANN was formed in > 1998 as a not-for-profit public-benefit corporation with a community of > participants from all over the world. > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_news_ann… > > _______________________________________________ > ksk-rollover mailing list > ksk-rollover(a)icann.org > https://mm.icann.org/mailman/listinfo/ksk-rollover _______________________________________________ ksk-rollover mailing list ksk-rollover(a)icann.org https://mm.icann.org/mailman/listinfo/ksk-rollover

2 1

Re: [ksk-rollover] 56-hour status check
by Davey宋 Oct. 14, 2018

Oct. 14, 2018

1 0

56-hour status check
by Paul Hoffman Oct. 14, 2018

Oct. 14, 2018

Even after 56 hours after the rollover, there were very few reports of problems, and those were mostly fixed quickly. --Paul Hoffman

1 0

24-hour status check
by Paul Hoffman Oct. 12, 2018

Oct. 12, 2018

In the first 24 hours after the rollover, there were very few reports of problems, and those were mostly fixed quickly. --Paul Hoffman

5 4

Re: [ksk-rollover] 答复: Chat session during KSK Rollover? Re: Reporting - Root KSK Rollover
by Medel Ramirez Oct. 12, 2018

Oct. 12, 2018

I think this is more exciting, going out Of your comfort “zone” . 0.02. ++++++ Sent from my V6 Engine! メデルラミレズ On 12 Oct 2018, at 7:50 AM, Davey Song(宋林健) <ljsong(a)biigroup.cn> wrote: It is easy to setup a non-validating resolver at hand. -----邮件原件----- 发件人: ksk-rollover [mailto:ksk-rollover-bounces@icann.org <ksk-rollover-bounces(a)icann.org>] 代表 Evan Hunt 发送时间: 2018年10月11日 6:08 收件人: Dan York 抄送: ksk-rollover(a)icann.org; Ralf Weber 主题: Re: [ksk-rollover] Chat session during KSK Rollover? Re: Reporting - Root KSK Rollover On Wed, Oct 10, 2018 at 08:50:47PM +0000, Dan York wrote: And so we confront the terrible state of real-time messaging best captured by this XKCD comic: https://xkcd.com/1810/ I know it's going to go fine and everything, but I can't help finding it amusing that every single suggestion for keeping in touch in case the internet breaks has been an internet service. Shouldn't we be using tin cans and string? :) -- Evan Hunt -- each(a)isc.org Internet Systems Consortium, Inc. _______________________________________________ ksk-rollover mailing list ksk-rollover(a)icann.org https://mm.icann.org/mailman/listinfo/ksk-rollover _______________________________________________ ksk-rollover mailing list ksk-rollover(a)icann.org https://mm.icann.org/mailman/listinfo/ksk-rollover -- This e-mail message (including attachments, if any) is intended for the use of the individual or the entity to whom it is addressed and may contain information that is privileged, proprietary, confidential and exempt from disclosure. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender and delete this E-mail message immediately.

1 0