-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 The key in our current zone was explicitly stated not to be used as a trust anchor yet: https://www.enum.nl/nl/dnssec/dnssec-status-for-13e164arpa.html That's why we don't expect users to have this configured. This message is therefore only informational, as we promised changes to our policy to be published on the relevant mailinglists. We tested rollovers for this zone already with this not to be trusted key. Our first intention was to have this key to be used as a trust anchor, as the root was not ready yet. Now that we are ready to submit our key to our parent, and the root is signed, we see no need to state our own trust anchor, so our policy changed. Since we will also replace our signing infrastructure, and the current key is not to be trusted anyway, we decided to start with a new key altogether. Antoin Verschuren Technical Policy Advisor SIDN Utrechtseweg 310, PO Box 5022, 6802 EA Arnhem, The Netherlands P: +31 26 3525500 F: +31 26 3525505 M: +31 6 23368970 mailto:antoin.verschuren@sidn.nl xmpp:antoin@jabber.sidn.nl http://www.sidn.nl/
-----Original Message----- From: dns-operations-bounces@lists.dns-oarc.net [mailto:dns-operations- bounces@lists.dns-oarc.net] On Behalf Of Doug Barton Sent: Saturday, January 08, 2011 3:39 AM To: Marco Davids Cc: dnssec@dnssec.nl; dns-operations@lists.dns-oarc.net; enum-wg@ripe.net; dnssec-deployment@dnssec-deployment.org Subject: Re: [dns-operations] [Dnssec-deployment] [ENUM-NL] DNSSEC trust- anchor notice for 1.3.e164.arpa.
On 01/07/2011 03:23, Marco Davids (SIDN) wrote:
Since we anticipate that only very few people have actually configured the present trust-anchor (if any), we will *not* perform a full-blown key roll-over. Instead we will simply remove the old key and introduce a new one.
With all due respect, I think this is the wrong approach. :) If your assessment is correct and very few people have the key configured IMO now is the perfect time to practice doing a proper rollover.
The new trust-anchor will not be published in an authenticated manner outside DNS (for example on an SSL-protected web page as before), because it will have it's DS record in the parent.
Assuming that there is a trust path all the way from this zone to the root, that's not only Ok, (once again IMO) that's preferable.
Doug
--
Nothin' ever doesn't change, but nothin' changes much. -- OK Go
Breadth of IT experience, and depth of knowledge in the DNS. Yours for the right price. :) http://SupersetSolutions.com/
_______________________________________________ dns-operations mailing list dns-operations@lists.dns-oarc.net https://lists.dns-oarc.net/mailman/listinfo/dns-operations -----BEGIN PGP SIGNATURE----- Version: 9.6.3 (Build 3017)
wsBVAwUBTSsezTqHrM883AgnAQgDSwf8Do9RhARTaqtTWkTsmbLpF4cCBrkSuxki gPGJTnumBYSgYwwrsTRYvMHONXQSB7iFvypsLSdnDhb0eLg5ueq4nsfp99oed0GL K3SQPnqc609WCWKqQqklQiSAHzVLbsvp9IFBSuwKEUnlw8ono/CrGzp06izGxFe4 1S1Nig5/NE4rgiUbTIFw9XU33rEJTuyGvlRQeKXZ5Rn4CEXUXCZoZ9vrt/ZBN54K xhReLrMNjmfMVy5M0N/aWa0CY3bBh3avYXNgExCEMO4kGReriUFO239/YZkFcys2 aEVRLzPRRzZmHgdSKugiUtFWvqggrNTKiQ8qDyVvt8+veLmX/TRAAg== =bMEw -----END PGP SIGNATURE-----