Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5407F1228B7 for ; Fri, 11 Jan 2019 06:07:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kWq473LbdOBA for ; Fri, 11 Jan 2019 06:07:48 -0800 (PST) Received: from out.east.pexch112.icann.org (out.east.pexch112.icann.org [162.216.194.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C0FF1200B3 for ; Fri, 11 Jan 2019 06:07:48 -0800 (PST) Received: from PMBX112-E1-VA-2.pexch112.icann.org (162.216.194.26) by PMBX112-E1-VA-1.pexch112.icann.org (162.216.194.24) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Fri, 11 Jan 2019 09:07:46 -0500 Received: from PMBX112-E1-VA-2.pexch112.icann.org ([162.216.194.26]) by PMBX112-E1-VA-2.pexch112.icann.org ([169.254.2.124]) with mapi id 15.00.1367.000; Fri, 11 Jan 2019 06:07:45 -0800 From: Matt Larson To: dnsop Thread-Topic: Root zone KSK-2010 is now revoked Thread-Index: AQHUqbcG1Q/RBnjWp0yaiRAeOf3qtA== Date: Fri, 11 Jan 2019 14:07:44 +0000 Message-ID: <536B7B2F-7C6B-4E6F-B527-2ACEC81E9B68@icann.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.47.234] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [DNSOP] Root zone KSK-2010 is now revoked X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Jan 2019 14:07:50 -0000 Dear colleagues, A few moments ago, at 1400 UTC today, 11 January 2019, ICANN's root zone ma= nagement partner, Verisign, published root zone serial number 2019011100 wi= th the RFC 5011 REVOKE bit set. As a result, KSK-2010's key tag has changed= from 19036 to 19164. In addition, the root DNSKEY RRset is now signed with= two KSKs: the current KSK (KSK-2017) as well as the former KSK (KSK-2010).= The second signature is required by RFC 5011 to prove possession of KSK-20= 10's private key to assert the revocation. This second signature makes the = response to a query for the root zone's DNSKEY RRset increase in size from = 1414 bytes to 1425 bytes. We don't expect any operational issues from this change. The DNSKEY RRset s= ize increase is small, and other zones currently publish considerably large= r apex DNSKEY RRsets without apparent issue. In addition, because KSK-2010 = has not been used for signing since the root KSK rollover to KSK-2017 on 11= October 2018, no DNSSEC validators that are currently validating correctly= can be depending on it. Nevertheless, please let us know if you suspect any issues or have any ques= tions. May we also suggest subscribing to ksk-rollover@icann.org to receive announ= cements and participate in discussion about the KSK rollover process in par= ticular and DNSSEC in the root zone in general. For the root zone management partners, Matt -- Matt Larson, VP of Research ICANN Office of the CTO matt.larson@icann.org