Re: [dnsext] historal root keys for upgrade path?

[Joe Abley <[e-mail]>]

On 2011-01-31, at 08:14, Phillip Hallam-Baker wrote:

> ICANN has reserved the right to roll the root and according to one post requires the ability to do so at 60 days notice.

Since we have a published DPS, let's refer to that rather than pulling numbers out of e-mail threads.

  https://www.iana.org/dnssec/icann-dps.txt


Joe

4.5.3.  Entity private key compromise procedures

4.5.3.1.  Key Signing Key compromise

   ICANN has established and maintains Emergency KSK roll-over
   procedures to ensure readiness for key compromise situations.

   Upon the suspected or known compromise of a Root Zone Key Signing
   Key, IKOS will assess the situation, develop an appropriate action
   plan, and implement the action plan with approval from the PMA and
   ICANN executive management.

   As part of the KSK emergency roll-over procedures, ICANN maintains
   the capability of being able to generate and publish an interim Trust
   Anchor within 48 hours.  In favorable circumstances, this interim
   Trust Anchor may be used to facilitate an orderly RFC 5011 [RFC5011]
   automatic KSK roll-over to a new and sanctioned Trust Anchor
   generated at a new scheduled key ceremony, held within reasonable
   time.

   ICANN will inform the community of any emergency as soon as possible
   using the channels stipulated in section 2.1.

4.5.3.2.  Key Signing Key loss

   If the private component of a Trust Anchor is permanently lost, the
   latest point in time where this loss is detected, will inevitably be
   at the key ceremony when it is supposed to be used.  At this point in
   time, the Root Zone Maintainer/ZSK Operator has signatures for at
   least 33 days (see 6.6) of independent operations.

   If possible, a new KSK will be generated at this key ceremony or
   another ceremony scheduled within 48 hours.  If ICANN is unable to
   accommodate the key ceremony, an interim KSK must be generated by
   ICANN and published as a Trust Anchor within the stipulated 48 hours.

   The community is then given a minimum of 30 days notice to add the
   new Trust Anchors to the validating resolvers before the DNSKEY RRset
   has to be re-signed with the new Trust Anchor.  Failure to update a
   validating resolver will render that resolver inoperable.

   ICANN will inform the community of any emergency as soon as possible
   using the channels stipulated in section 2.1.

   The old Trust Anchor will remain untouched in the key set for one 10
   days time slot (see section Section 6.6).  In the next consecutive
   time slot, the old Trust Anchor will be marked as revoked, and after
   this time slot the lost key is permanently removed.

4.5.3.3.  Zone Signing Key Compromise

   ICANN will support Root Zone Zone Signing Key emergency rollover in
   the case of RZ ZSK compromise while following VeriSign's procedural
   directions.  Refer to the Root Zone ZSK Operator's DPS for details.