IETF Logo Mail Archive

[DNSOP] Re: Call for adoption: draft-fobser-dnsop-dnssec-keyrestore-01 (Ends 2026-02-27)

Yorgos Thessalonikefs <yorgos@nlnetlabs.nl> Tue, 17 February 2026 14:23 UTC

Return-Path: <yorgos@nlnetlabs.nl>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 6F31AB8C3090 for <dnsop@mail2.ietf.org>; Tue, 17 Feb 2026 06:23:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.799
X-Spam-Level:
X-Spam-Status: No, score=-2.799 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=nlnetlabs.nl
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wn27SBRVVMcM for <dnsop@mail2.ietf.org>; Tue, 17 Feb 2026 06:23:15 -0800 (PST)
Received: from mout-b-112.mailbox.org (mout-b-112.mailbox.org [195.10.208.42]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 550FBB8C308A for <dnsop@ietf.org>; Tue, 17 Feb 2026 06:23:15 -0800 (PST)
Received: from smtp202.mailbox.org (smtp202.mailbox.org [10.196.197.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-112.mailbox.org (Postfix) with ESMTPS id 4fFhgs0rVHzDv3R for <dnsop@ietf.org>; Tue, 17 Feb 2026 15:23:05 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nlnetlabs.nl; s=MBO0001; t=1771338185; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=Ln7xXSYsCnw3Qb3WgWux1n17nqPqUO0E5eEoKDVrB9g=; b=btewuRY9d/kjX+YK28sUBBJr1QDR+tef4S5l4k66TC76I18wjqJGPUxV5x8wi53aYTx7fy 8stHhpQUz9Isp2axyHYSGAAWBl8BK6wh3RibLfRkcXzHGvulBYl61Lkj0lx6Cn/ak6jCUO CAw2CNvORAJw7qGk7MoHryMWC52jP6r/QnRBPoqu00ZBSCNSYbbYPmXReoydTR5zYg9V1m GM4kVCd0i0X78MDIw8ah+2bXQuWotiO56cR8npvZRWK1vhRQaFZXl8WnQ6qquC6b5dGkWS 2hXsraH2FOvSX6RPaED3qMqrEmOfROAB4wUfBHq5v0Ic8TEDjyF7Dahw3eJK5Q==
Message-ID: <d7b02d29-4c27-4cf5-9ea3-bd074af01d46@nlnetlabs.nl>
Date: Tue, 17 Feb 2026 15:23:03 +0100
MIME-Version: 1.0
To: dnsop@ietf.org
References: <177098446396.151334.4324573961934206864@dt-datatracker-6ff7c68975-7k42g>
Content-Language: en-GB
From: Yorgos Thessalonikefs <yorgos@nlnetlabs.nl>
Autocrypt: addr=yorgos@nlnetlabs.nl; keydata= xsFNBFfYHeYBEAC/8SdeXNspt9ZIoZRSL9juNLHA17TXcHdKSthgWBtwwWZbUPq8SJr7Y+hr 6jMCDKY9800QzLF0nLkyXnZgaBcvR0rRbCT/qvALJ0fpfjcotapZ1hBvomb9s8Bo28uKn8tb TMXYNsElUae4Ch/CrU1vfe50YoyQgLR8UBa15gV+2RmC+6jIqxDYS8sylWlDn6Qim+77feLl ObPnNdzgfWGZo14eJByTsz0qrh8aS/BS1FAsnEQ6W6AqukhpuKuWvoAUXKjfguXQolxeexub mKaLcGOTvecw+cbh/a5SPHRtRVr9qTxpelk6UEpakY5K9UtZkrG55VWih/4KqY9bNyhJBtpA k1fXA+mYfx5BcFpECYdU9kz4UgV5jK0HYRHQTLC91PPVQgH86we+Aae6TaJneCLEIzBK36Tg AP8RKrvFfPUym5OPYbWOom27QTKfRVcyxPKglJxrTSWixnKWS/pqxNY8hF9Ne4crRAF4wX2y BVbGnjNrS9TpYmjMwURbuYm+rWZk/8w5OJG60V3wax56c0jn/42O3Y2hzQ+PbOv2M4UuuajS 2YL3/KUsRLBapUpPQjzChwzdr/vzFEhk9XxK2VGMN+dh2HjYwDFendc5csyt/cVrg3LssVS2 bKy5g3IhrzCKAk0Sky4S5t/mcN+lWztNvCijuLz58GCym5GwJQARAQABzStZb3Jnb3MgVGhl c3NhbG9uaWtlZnMgPHlvcmdvc0BubG5ldGxhYnMubmw+wsGXBBMBCABBAhsjBQsJCAcCBhUI CQoLAgQWAgMBAh4BAheAAhkBFiEElI60IyLF0At5NA9dz/M0TZCHpJAFAmjWhkcFCRLfm+EA CgkQz/M0TZCHpJANXhAAvTpKNl5+kU1dlcFrXx4pgi/knhe0y1Z+ENQWVDYTs9v+lMoyCRQu At1Cir1LAGWfRBdTQh60I6DcBDj+15pFJCv/dyZiQLPUgxLtIxkwIUSjELp8JevNHhGMNz7Q WdG4SEpG2aF/D2ZzkvaoomPGjRyo/bkgR2la6eqrCOxYVP+FT7682yf0bCvSTs1kTrnwFY93 s7O2RciIMS0XWcHPtoi96JxhzUIT+v0gSFuitZhRGPh9pyIcHmRER1yKugvMp6xF5UjNIcfL ScrNlGXgjc6EJiGXS5CHliIlxlAxs4J1T9JiGQZOAW/CPxe4IND34DhqwvQcJdtL8jt1b2xU cuFfYNa3SY671OnLt3EhwMsYDaSIXrPqW8R6XuaSxhb4sL/okHkb833bCgaWvjQZgRm1h0R2 IY5C3kHotsLUd2fygrtVVvaLxGEoi9UBsKoLu2kHEJnV5HJOjfJMBBGgGFscfk3p1v4SAA30 xPR7i6O2KDmFsVzL6xKbnFMMmayEVfWzGXmxB7lvob6HrJIvVH6mx64OsAY0LQI6abQI3TTZ n13+RNxuATQS+j0tqbZvVJtWFw41eqsUOqeNF9W323uvhJcjDyYquAREIivFXkzxa9y3rgQf B9OX9usD79aij4y/YLqZxaflInYUlMGygNOGXruFRZ7DD6zciK2Zu7XOwU0EV9gd5gEQALaH 3KNJ7ZKC1wHQf4TSd1p7BplpAITur5E7jd2i0Yf14WdXATj9+1wrVI3jaKGUXk6dNoo/Je+B DpTxbxUHx4uN5PAD91Je4lfuQmkQryxo+ok/rNNSY+qn8ZLNLpiuEot+kWfhyGbLCkMVwY0z PSxheImA+oovtbQq4b7OI9OgB5aXxyR5fKXvv+UdWFZjKVpAkQBKSWoJWI9dKn28jv/ntQSb gxA9fCwME7C5VWpxK7dkzky1j1eVtU80JiZkgyqaHweBjBuKr11N8mL7q/Xv64NAZl7BYr9b AUz710PHtiRN44GJR25i0k9brg1b9EnumyRssDL45kClNlaDRwhI3oY6Y83cXQCJbNSO9IxE QeEUfLGPhjXm+4M4W88YXGvjEGLIxfUksIoro4WfI9+gn2/+jdSCtCAut9cKYp2+TAEKAm83 cWzHOFroO1/pFxnTZ+vtIJlmF0GuWt+W8LW5ZnSDcDzuyzuHgjDeeOU7dpfoGj1HhU4tSSJE qLiGZAHE+9fEjYRGYpGiajqWsxoMzMiMPgA9IzW9R9mC7NDFVikzyXDLUI56rGyPmn4sfp/8 RT7h1dnCignW5qcE68bae2fPxISsT57vA1gThr99vzFgziPunqpi2c1k9vyyPxu/HyJZengD VyxV63JVJyEGFNVCGE2izqi5ilziJutjABEBAAHCwXwEGAEIACYCGwwWIQSUjrQjIsXQC3k0 D13P8zRNkIekkAUCaNaGgAUJEt+cGgAKCRDP8zRNkIekkDiwD/sFms/ifBYXV5BWWIxYnUoo b6weLMrhz5mIHrtoUnDiksMIvmjq6c5YfxWhyvWlYL8EyYsbgrvs7app2FQfubNeb911n8NU XfEdO9OYbVbVst3rOPeTqo4VirzI9LZA1Nrf7eg1u1lD5Gm+EICa/YNzUYw80/aEpH8m72v0 3AZYEQNAG2IxnvzvZAnJHcgXJ9AZG+P4YFsQG8nAIWZpFvd4OiuFo2EzRvRz9Fsi54RYPjSe QJS2YzhmtzXQcuh3wuLwLiPywioh19MqjVGIlRSDzqrUrekYDzqGg7N5qKFl6RybrAzAaWFf KZs2DjXIH9lN52X3CT5cQRwPodkwJfJ+HnmEF1YbTpoSEwgAuM4KPZWRGcMuY4ouANmSDs45 DEN8oAIIK+TvYdkbeoq1o32g0fWh5pXBzfK1ZHzLaFAlwLGahCwuf5e+SBxphE2SU9bbPzzX snd+a+/BLSjqw5ZEctvRcBz41mDiURA6DBUWsTRcgCCRcctBu5AZGlHNGdwdf3lFczMZvX7y SlYRwzuBrOBQDeiagC6bA0SqZ4FfVOYS0OinWTlEUJJRZu/4DazYZIBvTkwdjQiciEzHMlcR rn50kM9K9mduIZEaFCK0R7h4iWY9w0DWUH4AMUTZRPNylFOjlw4p+tfJlevokISXb60Hejmb S/sVF2vr7MhLmA==
In-Reply-To: <177098446396.151334.4324573961934206864@dt-datatracker-6ff7c68975-7k42g>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Message-ID-Hash: OFMNXA3MZUZNPEGQS3O3PXR2PNJEXW7C
X-Message-ID-Hash: OFMNXA3MZUZNPEGQS3O3PXR2PNJEXW7C
X-MailFrom: yorgos@nlnetlabs.nl
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: Call for adoption: draft-fobser-dnsop-dnssec-keyrestore-01 (Ends 2026-02-27)
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/efM7tIovz3WZ8IAONnswA0iTsT4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

Hi,

On 13/02/2026 13:07, Peter Thomassen via Datatracker wrote:
> This message starts a dnsop WG Call for Adoption of:
> draft-fobser-dnsop-dnssec-keyrestore-01
> 
> This Working Group Call for Adoption ends on 2026-02-27
> 
> Abstract:
>     This document describes the issues surrounding the handling of DNSSEC
>     private keys in a DNSSEC signer.  It presents operational guidance in
>     case a DNSSEC private key becoming inoperable.
> 
I am in favour of adoption.

Although HSM usage is prominently mentioned in the introduction, I 
believe it can be diminished to just one example of private key absence.

Having a thought out informational document for this kind of procedure 
could be very valuable when needed.
The current alternatives are tribal knowledge (if present) or going 
insecure.

Best regards,
-- Yorgos

v2.46.0 | Report a Bug | By Email | System Status