<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Arial" size="2"><span style="font-size:10pt;">
<div>-----BEGIN PGP SIGNED MESSAGE-----</div>
<div>Hash: SHA256</div>
<div> </div>
<div>The key in our current zone was explicitly stated not to be used as a trust anchor yet:</div>
<div><a href="https://www.enum.nl/nl/dnssec/dnssec-status-for-13e164arpa.html">https://www.enum.nl/nl/dnssec/dnssec-status-for-13e164arpa.html</a></div>
<div>That's why we don't expect users to have this configured.</div>
<div>This message is therefore only informational, as we promised changes to our policy to be published on the relevant mailinglists.</div>
<div> </div>
<div>We tested rollovers for this zone already with this not to be trusted key.</div>
<div>Our first intention was to have this key to be used as a trust anchor, as the root was not ready yet.</div>
<div> </div>
<div>Now that we are ready to submit our key to our parent, and the root is signed, we see no need to state our own trust anchor, so our policy changed.</div>
<div>Since we will also replace our signing infrastructure, and the current key is not to be trusted anyway, we decided to start with a new key altogether.</div>
<div> </div>
<div>Antoin Verschuren</div>
<div> </div>
<div>Technical Policy Advisor SIDN</div>
<div>Utrechtseweg 310, PO Box 5022, 6802 EA Arnhem, The Netherlands</div>
<div> </div>
<div>P: +31 26 3525500 F: +31 26 3525505 M: +31 6 23368970</div>
<div><a href="mailto:antoin.verschuren@sidn.nl">mailto:antoin.verschuren@sidn.nl</a> xmpp:antoin@jabber.sidn.nl
<a href="http://www.sidn.nl/">http://www.sidn.nl/</a></div>
<div> </div>
<div> </div>
<div> </div>
<div>> -----Original Message-----</div>
<div>> From: dns-operations-bounces@lists.dns-oarc.net [<a href="mailto:dns-operations-">mailto:dns-operations-</a></div>
<div>> bounces@lists.dns-oarc.net] On Behalf Of Doug Barton</div>
<div>> Sent: Saturday, January 08, 2011 3:39 AM</div>
<div>> To: Marco Davids</div>
<div>> Cc: dnssec@dnssec.nl; dns-operations@lists.dns-oarc.net; enum-wg@ripe.net;</div>
<div>> dnssec-deployment@dnssec-deployment.org</div>
<div>> Subject: Re: [dns-operations] [Dnssec-deployment] [ENUM-NL] DNSSEC trust-</div>
<div>> anchor notice for 1.3.e164.arpa.</div>
<div>> </div>
<div>> On 01/07/2011 03:23, Marco Davids (SIDN) wrote:</div>
<div>> </div>
<div>> > Since we anticipate that only very few people have actually configured</div>
<div>> > the present trust-anchor (if any), we will *not* perform a full-blown</div>
<div>> > key roll-over. Instead we will simply remove the old key and introduce a</div>
<div>> > new one.</div>
<div>> </div>
<div>> With all due respect, I think this is the wrong approach. :) If your</div>
<div>> assessment is correct and very few people have the key configured IMO</div>
<div>> now is the perfect time to practice doing a proper rollover.</div>
<div>> </div>
<div>> > The new trust-anchor will not be published in an authenticated manner</div>
<div>> > outside DNS (for example on an SSL-protected web page as before),</div>
<div>> > because it will have it's DS record in the parent.</div>
<div>> </div>
<div>> Assuming that there is a trust path all the way from this zone to the</div>
<div>> root, that's not only Ok, (once again IMO) that's preferable.</div>
<div>> </div>
<div>> </div>
<div>> Doug</div>
<div>> </div>
<div>> --</div>
<div>> </div>
<div>> Nothin' ever doesn't change, but nothin' changes much.</div>
<div>> -- OK Go</div>
<div>> </div>
<div>> Breadth of IT experience, and depth of knowledge in the DNS.</div>
<div>> Yours for the right price. :) <a href="http://SupersetSolutions.com/">
http://SupersetSolutions.com/</a></div>
<div>> </div>
<div>> _______________________________________________</div>
<div>> dns-operations mailing list</div>
<div>> dns-operations@lists.dns-oarc.net</div>
<div>> <a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a></div>
<div>-----BEGIN PGP SIGNATURE-----</div>
<div>Version: 9.6.3 (Build 3017)</div>
<div> </div>
<div>wsBVAwUBTSsezTqHrM883AgnAQgDSwf8Do9RhARTaqtTWkTsmbLpF4cCBrkSuxki</div>
<div>gPGJTnumBYSgYwwrsTRYvMHONXQSB7iFvypsLSdnDhb0eLg5ueq4nsfp99oed0GL</div>
<div>K3SQPnqc609WCWKqQqklQiSAHzVLbsvp9IFBSuwKEUnlw8ono/CrGzp06izGxFe4</div>
<div>1S1Nig5/NE4rgiUbTIFw9XU33rEJTuyGvlRQeKXZ5Rn4CEXUXCZoZ9vrt/ZBN54K</div>
<div>xhReLrMNjmfMVy5M0N/aWa0CY3bBh3avYXNgExCEMO4kGReriUFO239/YZkFcys2</div>
<div>aEVRLzPRRzZmHgdSKugiUtFWvqggrNTKiQ8qDyVvt8+veLmX/TRAAg==</div>
<div>=bMEw</div>
<div>-----END PGP SIGNATURE-----</div>
<div> </div>
<div> </div>
</span></font>
</body>
</html>