- ksk-rollover - lists.icann.org

new KSK in the DNS
by Yasuhiro Orange Morishita / 森下泰宏 Feb. 13, 2024

Feb. 13, 2024

Hi, ICANN announced that IANA planed to start pre-publish the new KSK in the DNS in January 2024, but I haven't found it in the root zone yet. Does anyone know the current status? ICANN Announces Schedule to Generate New Keys for KSK Key Rollover https://www.icann.org/en/announcements/details/icann-announces-schedule-to-… -- Yasuhiro 'Orange' Morishita <yasuhiro(a)jprs.co.jp>

6 6

Draft Report of the Root Zone DNSSEC Algorithm Rollover Study
by James Mitchell Oct. 25, 2023

Oct. 25, 2023

ICANN recently published for public comment the draft report of the Root Zone DNSSEC Algorithm Rollover Study. https://www.icann.org/en/public-comment/proceeding/draft-report-of-the-root… The public comment period ends on 04 December 2023. What We Need Your Input On The design team was tasked with two key tasks: * providing guidance on how to select an algorithm for the root zone, and * investigating how a rollover could be conducted. The team specifically seeks feedback on their recommendations and whether the rollover methods are appropriate. The exact timing of an algorithm rollover and the design of detailed operational plans was out of scope for the design team. Kind regards, James Mitchell IANA

1 0

Needless to say, like anything else, there is a tradeoff
by Billie Gan Aug. 6, 2023

Aug. 6, 2023

<div dir="ltr">There is not much you can do with the existing keys but still, KMIP is something to consider going forward if one is concerned about vendor lock-ins.<div>Needless to say, like anything else, there is a tradeoff.</div><div><br></div><div>Cheers!</div><div>T.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jul 31, 2023 at 11:23â€¯PM Jakob Schlyter via ksk-rollover <<a href="mailto: ksk-rollover(a)icann.org">ksk-rollover(a)icann.org </a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 2023-07-31 at 14:53, Frederico A C Neves via ksk-rollover wrote:<br> <br> > From our experience besides admin interfaces, standard APIs for<br> > regular operations, generating keys, sign, verify etc... are available<br> > (PKCS#11/KMIP) from multiple vendors. But exporting/importing a key,<br> > specially with the no-export attribute set, among vendors is not<br> > available.<br> <br> I concur; moving keys not marked as CKA_EXTRACTABLE (at time of generation) is generally not supported (due to FIPS requirements).<br> <br> Â Â Â Â jakob<br> <br> -- <br> Jakob Schlyter<br> Kirei AB - <a href="http://www.kirei.se" rel="noreferrer" target="_blank"> www.kirei.se</a><br> _______________________________________________<br> ksk-rollover mailing list<br> <a href="mailto:ksk-rollover@icann.org" target="_blank"> ksk-rollover(a)icann.org</a><br> <a href="https://mm.icann.org/mailman/listinfo/ksk-rollover " rel="noreferrer" target="_blank"> https://mm.icann.org/mailman/listinfo/ksk-rollover</a><br> <br> _______________________________________________<br> By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href=" https://www.icann.org/privacy/policy" rel="noreferrer" target="_blank"> https://www.icann.org/privacy/policy </a>) and the website Terms of Service (<a href=" https://www.icann.org/privacy/tos" rel="noreferrer" target="_blank"> https://www.icann.org/privacy/tos </a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.<br> </blockquote></div>

1 0

Root Zone KSK Rollover and HSM Update
by James Mitchell Aug. 3, 2023

Aug. 3, 2023

In April we announced that the manufacturer of our hardware security modules (HSMs) will cease production of the devices https://mm.icann.org/pipermail/root-dnssec-announce/2023/000157.html. As noted in that communication, we continued with our previously announced plans to begin the first phases of a KSK rollover. We generated a new KSK at the KSK Ceremony 49 in April, and plan to replicate the KSK to the second facility in the upcoming KSK Ceremony 50 this week. In the past few months we've procured Keyper HSMs to both meet our replacement schedule and provide additional spare units. We've been engaging HSM manufacturers to identify a new vendor and collaborating with our root zone management partner, Verisign, who is also impacted in relation to management of the root zone ZSK. The operational considerations for the ZSK differ from the KSK, particularly given the need for online day-to-day signing, but the security of the root zone relies on the robustness of all of these parts. In light of the uncertainty surrounding the future configuration of the HSMs, we have decided to not immediately update the root zone trust anchor files with the digest of KSK-2023 immediately following Ceremony 50. There is a strong likelihood we will seek to generate a new KSK on a new HSM platform once operationalized, which will cause us to abandon the recently generated KSK. We will however retain the recently generated KSK for now should those plans not pan out in a suitable time frame. Potential options are being actively evaluated, and we expect to have developed a preferred remediation approach in the coming months. While we don't have all the answers at this time, we encourage questions and feedback from trusted community representatives and other interested observers. This input will help inform our future planning. James Mitchell Director, IANA Technical Services

7 7

Apologies for tonight
by Roy Arends May 3, 2023

May 3, 2023

I’m not able to make the call tonight Warmly, Roy

1 0

Meet the Root Zone Algorithm Rollover Design Team @ IETF 116
by James Mitchell March 30, 2023

March 30, 2023

Hello, The Root Zone Algorithm Rollover Study Design Team is hosting a public session at IETF 116 and invites you to join. Date: 29 March, 04:00 – 05:00 UTC Room: G301 Remote: https://icann.zoom.us/j/94974160556?pwd=eUdOVUFUWi9yZ3FtVVFrbTFJWDFmUT09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/94974160556?pwd=eUdOVUFU…> The team's goal is to develop a plan for changing the cryptographic algorithm used for the DNS root key signing and zone signing keys. The team has been meeting since early 2023 and many members are here at the IETF to progress this work. We’ll share an update on the progress and challenges that we face. We look forward to your questions and insight. Don’t worry if you are unable to make the session; the plan will be put to public comment. Follow the ksk-rollover mailing list<https://mm.icann.org/listinfo/ksk-rollover> for updates and announcements. Thanks, James Mitchell IANA

6 6

Schedule to generate next KSK
by James Mitchell March 3, 2023

March 3, 2023

Hi, ICANN announced the schedule to generate the next KSK. https://www.icann.org/en/announcements/details/icann-announces-schedule-to-… Kind regards, James Mitchell IANA

1 0

ICANN Convenes Design Team to Evolve Root Zone Security
by Paul Hoffman Feb. 22, 2023

Feb. 22, 2023

This was just announced by ICANN: https://www.icann.org/en/announcements/details/icann-convenes-design-team-t…

1 0

Root Zone Algorithm Rollover design team?
by Shane Kerr Feb. 18, 2023

Feb. 18, 2023

Hello all, According to this announcement (as well as a presentation from the ICANN DNS Symposium): https://www.icann.org/en/announcements/details/icann-calls-for-volunteers-t… The design team for the root algorithm rollover was going to be announced in early January. I didn't see any announcement on this ksk-rollover list, which seems to be the place where such things would be made, since it's the only thing mentioned on this page: https://www.icann.org/resources/pages/ksk-algorithm-rollover-en I eagerly await a harder, better, faster, stronger root KSK so am super excited to follow the progress. 😄 Cheers, -- Shane

3 2

will there be another keyrollover?
by Michael Richardson Sept. 9, 2022

Sept. 9, 2022

Seeing the monthly reminder of my mailing list membership. (mailman needed to randomize the chosen reminder date) Anyone done any experiments with signed root using some of the NIST candidates? RFC8806 keeps looking better and better to me. -- Michael Richardson <mcr+IETF(a)sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide

4 6