[From nobody Fri Dec 6 16:56:40 2019 Return-path: <dns-operations-bounces@dns-oarc.net> X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on carbon.time-travellers.nl.eu.org X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=HTML_MESSAGE,SPF_PASS, T_RP_MATCHES_RCVD autolearn=unavailable version=3.3.2 Envelope-to: shane@time-travellers.org Delivery-date: Tue, 07 Nov 2017 16:52:26 +0000 Received: from ix1.dns-oarc.net ([2620:ff:c000::198]) by time-travellers.nl.eu.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from <dns-operations-bounces@dns-oarc.net>) id 1eC76v-0006Mz-SQ for shane@time-travellers.org; Tue, 07 Nov 2017 16:52:26 +0000 Received: from ix1.dns-oarc.net (localhost [IPv6:::1]) by ix1.dns-oarc.net (8.14.4/8.14.4/Debian-4+deb7u1) with ESMTP id vA7GTTZH024540; Tue, 7 Nov 2017 16:30:00 GMT Received: from out.east.pexch112.icann.org (pfe112-va-1.pexch112.icann.org [162.216.194.7]) by ix1.dns-oarc.net (8.14.4/8.14.4/Debian-4+deb7u1) with ESMTP id vA7GTLBr024531 for <dns-operations@dns-oarc.net>; Tue, 7 Nov 2017 16:29:27 GMT Received: from PMBX112-E1-VA-2.pexch112.icann.org (162.216.194.26) by PMBX112-E1-VA-1.pexch112.icann.org (162.216.194.24) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Tue, 7 Nov 2017 08:29:19 -0800 Received: from PMBX112-E1-VA-2.pexch112.icann.org ([162.216.194.26]) by PMBX112-E1-VA-2.pexch112.icann.org ([169.254.2.45]) with mapi id 15.00.1178.000; Tue, 7 Nov 2017 08:29:19 -0800 From: Matt Larson <matt.larson@icann.org> To: dns-operations <dns-operations@dns-oarc.net> Thread-Topic: Update on root KSK roll project Thread-Index: AQHTV+WPx/pZcVu2WEeSWM0DRmyhzg== Date: Tue, 7 Nov 2017 16:29:19 +0000 Message-ID: <80F2258C-F790-45F8-9D2C-B63CD3138C72@icann.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.47.234] MIME-Version: 1.0 Authentication-Results: ix1.dns-oarc.net; dmarc=none header.from=icann.org Authentication-Results: ix1.dns-oarc.net; dmarc=none header.from=icann.org Subject: [dns-operations] Update on root KSK roll project X-BeenThere: dns-operations@lists.dns-oarc.net X-Mailman-Version: 2.1.23 Precedence: list List-Id: DNS Operations <dns-operations.lists.dns-oarc.net> List-Unsubscribe: <https://lists.dns-oarc.net/mailman/options/dns-operations>, <mailto:dns-operations-request@lists.dns-oarc.net?subject=unsubscribe> List-Archive: <http://lists.dns-oarc.net/pipermail/dns-operations/> List-Post: <mailto:dns-operations@lists.dns-oarc.net> List-Help: <mailto:dns-operations-request@lists.dns-oarc.net?subject=help> List-Subscribe: <https://lists.dns-oarc.net/mailman/listinfo/dns-operations>, <mailto:dns-operations-request@lists.dns-oarc.net?subject=subscribe> Content-Type: multipart/mixed; boundary="===============5331953481779310589==" Errors-To: dns-operations-bounces@dns-oarc.net Sender: "dns-operations" <dns-operations-bounces@dns-oarc.net> --===============5331953481779310589== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_80F2258CF79045F89D2CB63CD3138C72icannorg_" --_000_80F2258CF79045F89D2CB63CD3138C72icannorg_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Dear colleagues, I recently wrote an update on the root KSK roll project at https://www.ican= n.org/news/blog/update-on-the-root-ksk-roll-project. The text is reproduced= below for your convenience. Matt -- Matt Larson <matt.larson@icann.org<mailto:matt.larson@icann.org>> VP of Research, Office of the CTO, ICANN This post is the first in an ongoing series of updates on the status of the= root KSK roll project. We intend to keep the community updated on our effo= rts to proceed with the rollover. On 27 September 2017, the ICANN org announced<https://www.icann.org/news/an= nouncement-2017-09-27-en> we were postponing the root zone KSK roll. More r= ecently, on 17 October we published a paper entitled Postponing the Root KS= K Roll<https://www.icann.org/en/system/files/files/root-ksk-roll-postponed-= 17oct17-en.pdf> that gives further details on the information we received o= n the configuration of some resolvers that influenced the decision, our ana= lysis, and our reasoning behind the postponement. As we described in that paper<https://www.icann.org/en/system/files/files/r= oot-ksk-roll-postponed-17oct17-en.pdf>, the most recent versions of the BIN= D and Unbound recursive resolvers implement a protocol defined in RFC 8145<= https://www.rfc-editor.org/rfc/rfc8145.txt>, Signaling Trust Anchor Knowled= ge in DNS Security Extensions (DNSSEC), that allows a resolver to report it= s trust anchor configuration. A resolver supporting this feature reports it= s configured trust anchors for the root zone to the root name servers. Anal= ysis of this reported trust anchor data, in the weeks leading up to the pre= viously scheduled rollover date of 11 October 2017, led to concerns that th= ere could be a larger than anticipated population of resolvers not configur= ed with KSK-2017 (our shorthand for the next root zone KSK) as a trust anch= or. Those resolvers will be unable to resolve DNS queries when the rollover= occurs. The Research group in the Office of the CTO (OCTO) analyzed traffic to the = B, D, F and L root servers for the entire month of September 2017 and found= 11,982 unique IP addresses (8,908 IPv4 and 3,078 IPv6) sending trust ancho= r configuration information. Of those, 620 addresses reported being configu= red with only KSK-2010 (the shorthand for the current root zone KSK). Upon = further analysis, we were able to eliminate some false positives: IP addres= ses that, for various reasons, did not represent recursive resolvers perfor= ming DNSSEC validation. We reduced the list to 500 addresses of possible mi= sconfigured recursive resolvers whose operators we would like to contact. W= e have two main reasons for wanting to reach them: to understand the reason= their resolver reports being configured with only KSK-2010 and, if appropr= iate, to help them correct the configuration to be prepared for the rollove= r. We had initially planned to make this list of addresses public to enlist th= e community's help. Upon further reflection, we realized that such a list c= ould be taken out of context as an attempt to "name and shame" operators wi= th misconfigured systems, which is not our intent at all. We've decided to = make an initial attempt to contact the administrators ourselves. Depending = on the outcome, we might need to publish the list of addresses whose admini= strators we are unable to reach. According to the data from September mentioned above, 4.1% of IP addresses = report only KSK-2010. (The actual percentage of all resolvers on the Intern= et with only KSK-2010 might likely be higher, since only a very small numbe= r currently report trust anchor configuration.) We want to make a significa= nt improvement in that number through our investigation and mitigation. Sin= ce we don't know how many administrators we'll be able to contact, we don't= want to set a target percentage just yet. It's important to note that the value represents a percentage of resolvers,= not end users, and the impact on end users is what's most important. The c= riteria in the published operational plan<https://www.icann.org/en/system/f= iles/files/ksk-rollover-operational-implementation-plan-22jul16-en.pdf> for= backing out of the rollover in the event of problems references the effect= on end users: ICANN will consider back out of any step in the key roll process if the mea= surement program indicates a considerable amount of the estimated Internet = end-user population has been negatively impacted by the change 72 hours aft= er each change has been deployed into the root zone. These criteria were derived in part from the recommendations of the root KS= K roll design team that ICANN convened to help plan the rollover, whose rep= ort<https://www.iana.org/reports/2016/root-ksk-rollover-design-20160307.pdf= > includes this recommendation that also centers on end users: Recommendation 16: Rollback of any step in the key roll process should be i= nitiated if the measurement program indicated that a minimum of 0.5% of the= estimated Internet end-user population has been negatively impacted by the= change 72 hours after each change has been deployed into the root zone. Throughout this process, we will consider the end-user impact a more import= ant consideration than the absolute percentage of resolvers that still repo= rt only KSK-2010. After we've contacted as many resolver operators as we ca= n, we'll attempt to determine the number of end users affected by the remai= ning resolvers not yet reporting KSK-2017. Determining the number of end us= ers that use a particular resolver is difficult, but we have several ideas = and sources of data to help with this task. We'll report more on these efforts and other developments in future blog po= sts as we keep the community updated on our progress. --_000_80F2258CF79045F89D2CB63CD3138C72icannorg_ Content-Type: text/html; charset="us-ascii" Content-ID: <947265AA60AF4C46855ECB0A650F3C17@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > </head> <body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-lin= e-break: after-white-space;" class=3D""> <font face=3D"Courier New" class=3D"">Dear colleagues,</font> <div class=3D""><font face=3D"Courier New" class=3D""><br class=3D""> </font></div> <div class=3D""><font face=3D"Courier New" class=3D"">I recently wrote an u= pdate on the root KSK roll project at <a href=3D"https://www.icann.org= /news/blog/update-on-the-root-ksk-roll-project" class=3D"">https://www.ican= n.org/news/blog/update-on-the-root-ksk-roll-project</a>. The text is reproduced below for your convenience.</font></div> <div class=3D""><font face=3D"Courier New" class=3D""><br class=3D""> </font></div> <div class=3D""><font face=3D"Courier New" class=3D"">Matt</font></div> <div class=3D""><font face=3D"Courier New" class=3D"">--<br class=3D""> Matt Larson <<a href=3D"mailto:matt.larson@icann.org" class=3D"">matt.la= rson@icann.org</a>><br class=3D""> VP of Research, Office of the CTO, ICANN</font><br class=3D""> </div> <div class=3D""><br class=3D""> </div> <div class=3D""><br class=3D""> </div> <div class=3D""> <p style=3D"box-sizing: border-box; line-height: 1.4rem; font-size: 16px; m= argin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, ari= al, sans-serif;" class=3D""> This post is the first in an ongoing series of updates on the status of the= root KSK roll project. We intend to keep the community updated on our effo= rts to proceed with the rollover.</p> <p style=3D"box-sizing: border-box; line-height: 1.4rem; font-size: 16px; m= argin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, ari= al, sans-serif;" class=3D""> On 27 September 2017, the <span class=3D"">ICANN</span><span class=3D"= "> </span><span class=3D"">org</span> <a href=3D"https://www.ican= n.org/news/announcement-2017-09-27-en" style=3D"box-sizing: border-box; col= or: rgb(0, 152, 213); text-decoration: none;" class=3D"">announced</a>&nbsp= ;we were postponing the root zone KSK roll. More recently, on 17 October we pu= blished a paper entitled <a href=3D"https://www.icann.org/en/system/fi= les/files/root-ksk-roll-postponed-17oct17-en.pdf" style=3D"box-sizing: bord= er-box; color: rgb(0, 152, 213); text-decoration: none;" class=3D""><em sty= le=3D"box-sizing: border-box;" class=3D"">Postponing the Root KSK Roll</em></a> that gives further details on the informat= ion we received on the configuration of some resolvers that influenced the = decision, our analysis, and our reasoning behind the postponement.</p> <p style=3D"box-sizing: border-box; line-height: 1.4rem; font-size: 16px; m= argin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, ari= al, sans-serif;" class=3D""> As we described in that <a href=3D"https://www.icann.org/en/system/fil= es/files/root-ksk-roll-postponed-17oct17-en.pdf" style=3D"box-sizing: borde= r-box; color: rgb(0, 152, 213); text-decoration: none;" class=3D"">paper</a= >, the most recent versions of the <span class=3D"">BIND</span><span c= lass=3D""> </span><span class=3D"">and Unbound recursive resolvers implement a protocol defined in</span> <a= href=3D"https://www.rfc-editor.org/rfc/rfc8145.txt" style=3D"box-sizing: b= order-box; color: rgb(0, 152, 213); text-decoration: none;" class=3D""><abb= r title=3D"Request for Comments" class=3D"" style=3D"box-sizing: border-box= ; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; bo= rder-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor:= help; transition: all 0.2s;">RFC</abbr> 8145</a>, <em style=3D"b= ox-sizing: border-box;" class=3D"">Signaling Trust Anchor Knowledge in <abbr title=3D"Domain Name System" style=3D= "box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; borde= r-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(= 153, 153, 153); cursor: help; transition: all 0.2s;" class=3D"">DNS</abbr>&= nbsp;<span class=3D"">Security </span><span class=3D"">Extensions (</span><span class=3D"">DNSSEC</span><span class=3D"">)</span></em>, that= allows a resolver to report its trust anchor configuration. A resolver sup= porting this feature reports its configured trust anchors for the root zone= to the root name servers. Analysis of this reported trust anchor data, in the weeks leading up to the previou= sly scheduled rollover date of 11 October 2017, led to concerns that there = could be a larger than anticipated population of resolvers not configured w= ith KSK-2017 (our shorthand for the next root zone KSK) as a trust anchor. Those resolvers will be unable = to resolve <abbr title=3D"Domain Name System" style=3D"box-sizing: bor= der-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: = 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); = cursor: help; transition: all 0.2s;" class=3D"">DNS</abbr> queries when the rollover occurs.</p> <p style=3D"box-sizing: border-box; line-height: 1.4rem; font-size: 16px; m= argin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, ari= al, sans-serif;" class=3D""> The Research group in the Office of the CTO (OCTO) analyzed traffic to the = B, D, F and L root servers for the entire month of September 2017 and found= 11,982 unique <span class=3D"">IP</span><span class=3D""> </span= ><span class=3D"">addresses (8,908 IPv4 and 3,078 IPv6) sending trust anchor configuration information. Of those, 620 a= ddresses reported being configured with only KSK-2010 (the shorthand for th= e current root zone KSK). Upon further analysis, we were able to elimi= nate some false positives:</span> <span class=3D"">IP</span><span clas= s=3D""> </span><span class=3D"">addresses that, for various reasons, did not represent recursive resolvers performin= g</span> <span class=3D"">DNSSEC</span><span class=3D""> </span><= span class=3D"">validation. We reduced the list to 500 addresses of possibl= e misconfigured recursive resolvers whose operators we would like to contact. We have two main reasons for wanting to rea= ch them: to understand the reason their resolver reports being configured w= ith only KSK-2010 and, if appropriate, to help them correct the configurati= on to be prepared for the rollover.</span></p> <p style=3D"box-sizing: border-box; line-height: 1.4rem; font-size: 16px; m= argin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, ari= al, sans-serif;" class=3D""> We had initially planned to make this list of addresses public to enlist th= e community's help. Upon further reflection, we realized that such a list c= ould be taken out of context as an attempt to "name and shame" op= erators with misconfigured systems, which is not our intent at all. We've decided to make an initial attempt to cont= act the administrators ourselves. Depending on the outcome, we might need t= o publish the list of addresses whose administrators we are unable to reach= .</p> <p style=3D"box-sizing: border-box; line-height: 1.4rem; font-size: 16px; m= argin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, ari= al, sans-serif;" class=3D""> According to the data from September mentioned above, 4.1% of <span cl= ass=3D"">IP</span><span class=3D""> </span><span class=3D"">addresses = report only KSK-2010. (The actual percentage of all resolvers on the I= nternet with only KSK-2010 might likely be higher, since only a very small number currently report trust anchor configuration.= ) We want to make a significant improvement in that number through our inve= stigation and mitigation. Since we don't know how many administrators = we'll be able to contact, we don't want to set a target percentage just yet.</span></p> <p style=3D"box-sizing: border-box; line-height: 1.4rem; font-size: 16px; m= argin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, ari= al, sans-serif;" class=3D""> It's important to note that the value represents a percentage of resolvers,= not end users, and the impact on end users is what's most important. The c= riteria in the <a href=3D"https://www.icann.org/en/system/files/files/= ksk-rollover-operational-implementation-plan-22jul16-en.pdf" style=3D"box-s= izing: border-box; color: rgb(0, 152, 213); text-decoration: none;" class= =3D"">published operational plan</a> for backing out of the rollover in the event of = problems references the effect on end users:</p> <p style=3D"box-sizing: border-box; line-height: 1.4rem; font-size: 16px; m= argin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, ari= al, sans-serif;" class=3D""> <em style=3D"box-sizing: border-box;" class=3D""><abbr title=3D"Internet Co= rporation for Assigned Names and Numbers" style=3D"box-sizing: border-box; = unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; bord= er-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: h= elp; transition: all 0.2s;" class=3D"">ICANN</abbr> will consider back out of any step in the key roll process if the measurement p= rogram indicates a considerable amount of the estimated Internet end-user p= opulation has been negatively impacted by the change 72 hours after each ch= ange has been deployed into the root zone.</em></p> <p style=3D"box-sizing: border-box; line-height: 1.4rem; font-size: 16px; m= argin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, ari= al, sans-serif;" class=3D""> These criteria were derived in part from the recommendations of the root KS= K roll design team that <span class=3D"">ICANN</span><span class=3D"">=  </span><span class=3D"">convened to help plan the rollover, whos= e</span> <a href=3D"https://www.iana.org/reports/2016/root-ksk-rollove= r-design-20160307.pdf" style=3D"box-sizing: border-box; color: rgb(0, 152, = 213); text-decoration: none;" class=3D"">report</a> includes this recommendation that also centers on end users:</p> <p style=3D"box-sizing: border-box; line-height: 1.4rem; font-size: 16px; m= argin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, ari= al, sans-serif;" class=3D""> <em style=3D"box-sizing: border-box;" class=3D"">Recommendation 16: Rollbac= k of any step in the key roll process should be initiated if the measuremen= t program indicated that a minimum of 0.5% of the estimated Internet end-us= er population has been negatively impacted by the change 72 hours after each change has been deployed into the root z= one.</em></p> <p style=3D"box-sizing: border-box; line-height: 1.4rem; font-size: 16px; m= argin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, ari= al, sans-serif;" class=3D""> Throughout this process, we will consider the end-user impact a more import= ant consideration than the absolute percentage of resolvers that still repo= rt only KSK-2010. After we've contacted as many resolver operators as we ca= n, we'll attempt to determine the number of end users affected by the remaining resolvers not yet reporting = KSK-2017. Determining the number of end users that use a particular resolve= r is difficult, but we have several ideas and sources of data to help with = this task.</p> <p style=3D"box-sizing: border-box; line-height: 1.4rem; font-size: 16px; m= argin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, ari= al, sans-serif;" class=3D""> We'll report more on these efforts and other developments in future blog po= sts as we keep the community updated on our progress.</p> </div> </body> </html> --_000_80F2258CF79045F89D2CB63CD3138C72icannorg_-- --===============5331953481779310589== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ dns-operations mailing list dns-operations@lists.dns-oarc.net https://lists.dns-oarc.net/mailman/listinfo/dns-operations dns-operations mailing list https://lists.dns-oarc.net/mailman/listinfo/dns-operations --===============5331953481779310589==-- ]