[ENUM-NL] DNSSEC trust-anchor notice for 1.3.e164.arpa.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [Apologies for any duplicate mails] DNSSEC trust-anchor notice for 1.3.e164.arpa. First and only notice! To whom it may concern: ENUM-zone 1.3.e164.arpa is signed with DNSSEC. Since no trust-anchor has been published in the parent, the trust-anchor of this zone was available via https://www.enum.nl/downloads/KSK-pub.txt. This is to inform you that we have scheduled a key change, which will render the current trust-anchor invalid. If you have configured the 1.3.e164.arpa trust-anchor in your validator(s), please remove it NOW or no later than January 11th 23:59 CET. At the end of next week we will introduce a new key in the 1.3.e164.arpa-zone, which will have it's trust-anchor published in the parent soon after. Since we anticipate that only very few people have actually configured the present trust-anchor (if any), we will *not* perform a full-blown key roll-over. Instead we will simply remove the old key and introduce a new one. The new trust-anchor will not be published in an authenticated manner outside DNS (for example on an SSL-protected web page as before), because it will have it's DS record in the parent. Thank you for your understanding. With kind regards, - -- Marco Davids On behalf of ENUM NL -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk0m94cACgkQXOb5yambhgnSGgCgpDvgMZ9Kd4cZs+g1oo8Y6ciI XQAAnjWrNJtYY0WN7aAPxNYNsegYhaT4 =8eSF -----END PGP SIGNATURE-----
On 01/07/2011 03:23, Marco Davids (SIDN) wrote:
Since we anticipate that only very few people have actually configured the present trust-anchor (if any), we will *not* perform a full-blown key roll-over. Instead we will simply remove the old key and introduce a new one.
With all due respect, I think this is the wrong approach. :) If your assessment is correct and very few people have the key configured IMO now is the perfect time to practice doing a proper rollover.
The new trust-anchor will not be published in an authenticated manner outside DNS (for example on an SSL-protected web page as before), because it will have it's DS record in the parent.
Assuming that there is a trust path all the way from this zone to the root, that's not only Ok, (once again IMO) that's preferable. Doug -- Nothin' ever doesn't change, but nothin' changes much. -- OK Go Breadth of IT experience, and depth of knowledge in the DNS. Yours for the right price. :) http://SupersetSolutions.com/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 The key in our current zone was explicitly stated not to be used as a trust anchor yet: https://www.enum.nl/nl/dnssec/dnssec-status-for-13e164arpa.html That's why we don't expect users to have this configured. This message is therefore only informational, as we promised changes to our policy to be published on the relevant mailinglists. We tested rollovers for this zone already with this not to be trusted key. Our first intention was to have this key to be used as a trust anchor, as the root was not ready yet. Now that we are ready to submit our key to our parent, and the root is signed, we see no need to state our own trust anchor, so our policy changed. Since we will also replace our signing infrastructure, and the current key is not to be trusted anyway, we decided to start with a new key altogether. Antoin Verschuren Technical Policy Advisor SIDN Utrechtseweg 310, PO Box 5022, 6802 EA Arnhem, The Netherlands P: +31 26 3525500 F: +31 26 3525505 M: +31 6 23368970 mailto:antoin.verschuren@sidn.nl xmpp:antoin@jabber.sidn.nl http://www.sidn.nl/
-----Original Message----- From: dns-operations-bounces@lists.dns-oarc.net [mailto:dns-operations- bounces@lists.dns-oarc.net] On Behalf Of Doug Barton Sent: Saturday, January 08, 2011 3:39 AM To: Marco Davids Cc: dnssec@dnssec.nl; dns-operations@lists.dns-oarc.net; enum-wg@ripe.net; dnssec-deployment@dnssec-deployment.org Subject: Re: [dns-operations] [Dnssec-deployment] [ENUM-NL] DNSSEC trust- anchor notice for 1.3.e164.arpa.
On 01/07/2011 03:23, Marco Davids (SIDN) wrote:
Since we anticipate that only very few people have actually configured the present trust-anchor (if any), we will *not* perform a full-blown key roll-over. Instead we will simply remove the old key and introduce a new one.
With all due respect, I think this is the wrong approach. :) If your assessment is correct and very few people have the key configured IMO now is the perfect time to practice doing a proper rollover.
The new trust-anchor will not be published in an authenticated manner outside DNS (for example on an SSL-protected web page as before), because it will have it's DS record in the parent.
Assuming that there is a trust path all the way from this zone to the root, that's not only Ok, (once again IMO) that's preferable.
Doug
--
Nothin' ever doesn't change, but nothin' changes much. -- OK Go
Breadth of IT experience, and depth of knowledge in the DNS. Yours for the right price. :) http://SupersetSolutions.com/
_______________________________________________ dns-operations mailing list dns-operations@lists.dns-oarc.net https://lists.dns-oarc.net/mailman/listinfo/dns-operations -----BEGIN PGP SIGNATURE----- Version: 9.6.3 (Build 3017)
wsBVAwUBTSsezTqHrM883AgnAQgDSwf8Do9RhARTaqtTWkTsmbLpF4cCBrkSuxki gPGJTnumBYSgYwwrsTRYvMHONXQSB7iFvypsLSdnDhb0eLg5ueq4nsfp99oed0GL K3SQPnqc609WCWKqQqklQiSAHzVLbsvp9IFBSuwKEUnlw8ono/CrGzp06izGxFe4 1S1Nig5/NE4rgiUbTIFw9XU33rEJTuyGvlRQeKXZ5Rn4CEXUXCZoZ9vrt/ZBN54K xhReLrMNjmfMVy5M0N/aWa0CY3bBh3avYXNgExCEMO4kGReriUFO239/YZkFcys2 aEVRLzPRRzZmHgdSKugiUtFWvqggrNTKiQ8qDyVvt8+veLmX/TRAAg== =bMEw -----END PGP SIGNATURE-----
participants (3)
-
Antoin Verschuren -
Doug Barton -
Marco Davids (SIDN)