Retention of the 2010 KSK
To Whom It May Concern, We have carefully reviewed the recent discussions about retaining KSK-2010 beyond its scheduled lifetime to enable a possible future as-yet-undefined technique to bootstrap a validator that has been offline for an extended period. We have decided to proceed with the deletion of the KSK-2010 as scheduled on 16 May 2019 from the Key Management Facility (KMF) East and then on 14 August 2019 from the KMF West. We have made the decision based on these factors: * On 11 January 2019, the root zone was published with KSK-2010 marked as revoked. The KSK-2010 key was also marked as expired in the root-anchors.xml file. * Since 22 March 2019, the root zone is no longer published with KSK-2010 in the DNSKEY record set. * We have not received a strong indication of how the KSK-2010 would be used in the future. * It seems likely any technique to bootstrap offline validators would be implemented in software that can reasonably assumed to, at a minimum, be configured with KSK-2017. * Deletion of the KSK-2010 is an activity prescribed in the KSK rollover plan [1] and also in the DNSSEC Practice Statements (DPS) [2]. Thank you, -- David Prangnell Email: david.prangnell@iana.org<mailto:david.prangnell@iana.org> IANA [1] Page 15 at https://www.icann.org/en/system/files/files/ksk-rollover-operational-impleme... [2] Section 6.5 at https://www.iana.org/dnssec/dps/ksk-operator/ksk-dps.txt
thank you. Clear and as always planned. Thanks David On Wed, Apr 24, 2019 at 11:58 AM David Prangnell <david.prangnell@iana.org> wrote:
To Whom It May Concern,
We have carefully reviewed the recent discussions about retaining KSK-2010 beyond its scheduled lifetime to enable a possible future as-yet-undefined technique to bootstrap a validator that has been offline for an extended period. We have decided to proceed with the deletion of the KSK-2010 as scheduled on 16 May 2019 from the Key Management Facility (KMF) East and then on 14 August 2019 from the KMF West.
We have made the decision based on these factors:
- On 11 January 2019, the root zone was published with KSK-2010 marked as revoked. The KSK-2010 key was also marked as expired in the root-anchors.xml file. - Since 22 March 2019, the root zone is no longer published with KSK-2010 in the DNSKEY record set. - We have not received a strong indication of how the KSK-2010 would be used in the future. - It seems likely any technique to bootstrap offline validators would be implemented in software that can reasonably assumed to, at a minimum, be configured with KSK-2017. - Deletion of the KSK-2010 is an activity prescribed in the KSK rollover plan [1] and also in the DNSSEC Practice Statements (DPS) [2].
Thank you,
--
David Prangnell
Email: david.prangnell@iana.org
IANA
[1] Page 15 at https://www.icann.org/en/system/files/files/ksk-rollover-operational-impleme...
[2] Section 6.5 at https://www.iana.org/dnssec/dps/ksk-operator/ksk-dps.txt
_______________________________________________ ksk-rollover mailing list ksk-rollover@icann.org https://mm.icann.org/mailman/listinfo/ksk-rollover
Thanks. Your reasoning is clear, and this seems like good cryptographic key hygiene as promised in the KSK DPS. Russ
On Apr 24, 2019, at 2:57 PM, David Prangnell <david.prangnell@iana.org> wrote:
To Whom It May Concern,
We have carefully reviewed the recent discussions about retaining KSK-2010 beyond its scheduled lifetime to enable a possible future as-yet-undefined technique to bootstrap a validator that has been offline for an extended period. We have decided to proceed with the deletion of the KSK-2010 as scheduled on 16 May 2019 from the Key Management Facility (KMF) East and then on 14 August 2019 from the KMF West.
We have made the decision based on these factors: On 11 January 2019, the root zone was published with KSK-2010 marked as revoked. The KSK-2010 key was also marked as expired in the root-anchors.xml file. Since 22 March 2019, the root zone is no longer published with KSK-2010 in the DNSKEY record set. We have not received a strong indication of how the KSK-2010 would be used in the future. It seems likely any technique to bootstrap offline validators would be implemented in software that can reasonably assumed to, at a minimum, be configured with KSK-2017. Deletion of the KSK-2010 is an activity prescribed in the KSK rollover plan [1] and also in the DNSSEC Practice Statements (DPS) [2].
Thank you, -- David Prangnell Email: david.prangnell@iana.org <mailto:david.prangnell@iana.org> IANA
[1] Page 15 at https://www.icann.org/en/system/files/files/ksk-rollover-operational-impleme... <https://www.icann.org/en/system/files/files/ksk-rollover-operational-impleme...> [2] Section 6.5 at https://www.iana.org/dnssec/dps/ksk-operator/ksk-dps.txt <https://www.iana.org/dnssec/dps/ksk-operator/ksk-dps.txt>
Excellent, thank you - partly for the decision, but even more so for the clear communication, backed up with clear reasoning. W On Wed, Apr 24, 2019 at 2:58 PM David Prangnell <david.prangnell@iana.org> wrote:
To Whom It May Concern,
We have carefully reviewed the recent discussions about retaining KSK-2010 beyond its scheduled lifetime to enable a possible future as-yet-undefined technique to bootstrap a validator that has been offline for an extended period. We have decided to proceed with the deletion of the KSK-2010 as scheduled on 16 May 2019 from the Key Management Facility (KMF) East and then on 14 August 2019 from the KMF West.
We have made the decision based on these factors:
- On 11 January 2019, the root zone was published with KSK-2010 marked as revoked. The KSK-2010 key was also marked as expired in the root-anchors.xml file. - Since 22 March 2019, the root zone is no longer published with KSK-2010 in the DNSKEY record set. - We have not received a strong indication of how the KSK-2010 would be used in the future. - It seems likely any technique to bootstrap offline validators would be implemented in software that can reasonably assumed to, at a minimum, be configured with KSK-2017. - Deletion of the KSK-2010 is an activity prescribed in the KSK rollover plan [1] and also in the DNSSEC Practice Statements (DPS) [2].
Thank you,
--
David Prangnell
Email: david.prangnell@iana.org
IANA
[1] Page 15 at https://www.icann.org/en/system/files/files/ksk-rollover-operational-impleme...
[2] Section 6.5 at https://www.iana.org/dnssec/dps/ksk-operator/ksk-dps.txt
_______________________________________________ ksk-rollover mailing list ksk-rollover@icann.org https://mm.icann.org/mailman/listinfo/ksk-rollover
-- I don't think the execution is relevant when it was obviously a bad idea in the first place. This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants. ---maf
participants (4)
-
David Prangnell -
Mehmet Akcin -
Russ Housley -
Warren Kumari