<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Message: 11<br>Date: Wed, 22 Dec 2010 16:15:00 -0500<br>From: Matt Larson <<a href="mailto:mlarson@verisign.com">mlarson@verisign.com</a>><br>Subject: .gov DNSSEC operational message<br>To: <a href="mailto:nanog@nanog.org">nanog@nanog.org</a><br>Message-ID: <<a href="mailto:20101222211500.GF97136@DUL1MLARSON-M1.vcorp.ad.vrsn.com">20101222211500.GF97136@DUL1MLARSON-M1.vcorp.ad.vrsn.com</a>><br>Content-Type: text/plain; charset=us-ascii; x-action=pgp-signed<br><br>-----BEGIN PGP SIGNED MESSAGE-----<br>Hash: SHA1<br><br>A KSK roll for the .gov zone will occur at the end of January, 2011.<br>This key change is necessitated by a registry operator transition:<br>VeriSign has been selected by the U.S. General Services Administration<br>(GSA) to operate the domain name registry for .gov. It is important<br>that you prepare for this key change NOW.<br><br>DO NOT WAIT until late January, 2011, to take action: the changes<br>described below should be made as soon as possible.<br><br>Because .gov was signed prior to the signing of the root zone, it is<br>reasonable to believe that many DNSSEC validators (usually part of<br>recursive name servers) have the .gov zone's KSK statically configured<br>as a trust anchor. Further, because automated trust anchor rollover<br>software implementing the protocol described in RFC 5011 has not been<br>widely available until recently, it is reasonable to believe that few<br>validators with a statically configured .gov trust anchor would be<br>able to understand a KSK roll using RFC 5011 semantics and update<br>their trust anchor store automatically.<br><br>VeriSign is sending this message to announce the impending .gov KSK<br>roll so that the DNSSEC operational community will be informed of the<br>change and has the opportunity to take the necessary steps to prepare<br>for it.<br><br>The .gov KSK roll will occur between 27 January 2011 and 31 January<br>2011. The rollover will not use RFC 5011 semantics because of issues<br>surrounding the registry operator transition.<br><br>The new KSK will not be published in an authenticated manner outside<br>DNS (e.g., on an SSL-protected web page). Rather, the intended<br>mechanism for trusting the new KSK is via the signed root zone: DS<br>records corresponding to the new KSK are already present in the root<br>zone.<br><br>Because the root zone has had DS records corresponding to the current<br>.gov KSK since 27 October 2010, static configuration of a trust anchor<br>for .gov is currently no longer strictly necessary.<br><br>Because there will be no non-DNS-based mechanism to authenticate<br>subsequent .gov KSKs, configuration of the .gov KSK as a trust anchor<br>is NOT RECOMMENDED.<br><br>Take these steps NOW to prepare for the .gov KSK roll in late January<br>2011:<br><br>1. If your DNSSEC validators DO NOT HAVE a trust anchor for the root<br>zone configured, CONFIGURE the root zone's KSK as a trust anchor. An<br>authenticated version of the root zone's KSK is available at<br><a href="http://data.iana.org/root-anchors/">http://data.iana.org/root-anchors/</a>.<br><br>2. If your DNSSEC validators have a trust anchor for the .gov zone<br>configured, REMOVE the .gov zone's KSK as a trust anchor from your<br>validator's configuration.<br><br>If you follow both steps above, your DNSSEC validators should continue<br>to validate names in .gov, but the .gov KSK will be authenticated via<br>the signed root's KSK rather than a locally configured trust anchor.<br><br>DO NOT WAIT until late January, 2011, to take these actions: the trust<br>anchor changes described above should be made as soon as possible.<br><br>If you have any questions or comments, please send email to<br><a href="mailto:registrar@dotgov.gov">registrar@dotgov.gov</a> or reply to this message.<br>-----BEGIN PGP SIGNATURE-----<br>Version: GnuPG v1.4.11 (Darwin)<br><br>iQEVAwUBTRJqVNdGiUJktOYBAQJaHQf+OKcKsnUySDLzwdMUdjDpFhvm53iJF4RN<br>/fWMK+5ahTqWpWgDnMi0NZij6OKCu+jUtH75Q9z4iXglyQzl5rweL4N01jV7GquV<br>tYO18ys2lQ7w07XFP2Y8568ckYeWkDgYGwHJ4GKRMW4/cyl6YlE3Z+sxMbn/O3/G<br>CcaTgmVtVHkVvLJfPMotaE9M4ldAlM3yMAHQspadVPrBNtzmYUBjJhjvwe1XxAok<br>UBJLwqubSnY2qoAsXrwcHov4Z1izxMiuLIthyjoc79r11J0CYzwDNpDd2QyPD/3y<br>7nFHlxCIYDm9r2lnv8sbc/p+/PuM7rpzpkCUvpWY9FArZWt7h7gSfA==<br>=+pAa<br>-----END PGP SIGNATURE-----<br><br></body></html>