<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mv="http://macVmlSchemaUri" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Courier New";
panose-1:2 7 3 9 2 2 5 2 4 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New",serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier",serif;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Georgia",serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
span.EmailStyle21
{mso-style-type:personal-compose;
font-family:"Georgia",serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:595.0pt 842.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1027"/>
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1"/>
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Georgia",serif;mso-fareast-language:EN-US">All,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Georgia",serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Georgia",serif;mso-fareast-language:EN-US">As stated before we are happy with our Luna’s. But to be quite honest, I am not sure if the HSM manufacturers are going in the same direction
as we do as DNSSEC operators. Support of new algorithms are slow (ECDSA support is minimal, let’s not talk about the new Edwards curve algorithms). And also, I find their commitment towards DNSSEC much less, then was the case 5-6 years ago. So, this worries
me.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Georgia",serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Georgia",serif;mso-fareast-language:EN-US">I like the CrypTech project very much, but without our financial support from (like this) community, it won’t see a maturity as we have with
the current HSM in the market today. Features like high availability, networked devices, and horizontal scaling for optimizing signing speeds are necessary to run our TLD business…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Georgia",serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Georgia",serif;mso-fareast-language:EN-US">My 2 cents,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Georgia",serif;mso-fareast-language:EN-US">Marc<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Georgia",serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:12.0pt;color:black">From:
</span></b><span lang="EN-US" style="font-size:12.0pt;color:black">dns-operations <dns-operations-bounces@dns-oarc.net> on behalf of Georg Kahest <georg.kahest@internet.ee><br>
<b>Date: </b>Wednesday, 6 September 2017 at 15:41<br>
<b>To: </b>Barry O'Donovan <barry+dnsops@islandbridgenetworks.ie>, dns-operations <dns-operations@dns-oarc.net><br>
<b>Subject: </b>Re: [dns-operations] HSM recommendations<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">On 09/06/17 09:27, Barry O'Donovan wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre><span lang="EN-US">This looks like an interesting project but I cannot recommend or advise<o:p></o:p></span></pre>
<pre><span lang="EN-US">avoidance:<o:p></o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US"><a href="https://cryptech.is/">https://cryptech.is/</a><o:p></o:p></span></pre>
<pre><span lang="EN-US"><a href="https://ripe69.ripe.net/presentations/136-141106.ripe-cryptech.pdf">https://ripe69.ripe.net/presentations/136-141106.ripe-cryptech.pdf</a><o:p></o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US">I'd be interested in anyone's experience / thoughts on this.<o:p></o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US">Also the new emergence of cloud based services:<o:p></o:p></span></pre>
<pre><span lang="EN-US"><a href="https://aws.amazon.com/cloudhsm/">https://aws.amazon.com/cloudhsm/</a><o:p></o:p></span></pre>
</blockquote>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US">aws cloudhsm used to be ran on Safenet hardware, i wonder what they use now<o:p></o:p></span></p>
<p><b><span lang="EN-US">Q: Will my Safenet-based HSMs be retired?</span></b><span lang="EN-US"><o:p></o:p></span></p>
<p><span lang="EN-US">No. While we believe the feature set and cost of the new CloudHSM service offer a far more attractive alternative, we will maintain AWS CloudHSM Classic for existing customers. Resources will be available shortly to assist in migrating
from CloudHSM Classic to the new service.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US"><a href="https://aws.amazon.com/cloudhsm/faqs/">https://aws.amazon.com/cloudhsm/faqs/</a><br>
<br>
<br>
<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre><span lang="EN-US"> - Barry<o:p></o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre><span lang="EN-US">Bill Woodcock wrote:<o:p></o:p></span></pre>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre><span lang="EN-US">On Sep 5, 2017, at 12:25 PM, Brett <a href="mailto:brettcarr@gmail.com"><brettcarr@gmail.com></a> wrote:<o:p></o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US">It's been a long time since I looked at HSM's (my previous<o:p></o:p></span></pre>
<pre><span lang="EN-US">experience is with Sun (PCI) and Thales (Network), but this was<o:p></o:p></span></pre>
<pre><span lang="EN-US">all a few years ago now. What is popular these days and is there<o:p></o:p></span></pre>
<pre><span lang="EN-US">any that anyone would particularly avoid or recommend.<o:p></o:p></span></pre>
</blockquote>
<pre><span lang="EN-US">We have a fleet of AEP Keypers, which we’ve been extraordinarily<o:p></o:p></span></pre>
<pre><span lang="EN-US">happy with. They’ve worked exactly as advertised, without any<o:p></o:p></span></pre>
<pre><span lang="EN-US">hiccups, and AEP’s support has been outstanding, when we’ve wanted<o:p></o:p></span></pre>
<pre><span lang="EN-US">to do things outside-of-the-ordinary. I think we’re signing ~100<o:p></o:p></span></pre>
<pre><span lang="EN-US">TLDs with them, been using them for about six years, just finished<o:p></o:p></span></pre>
<pre><span lang="EN-US">a rotation out for their routine-service and battery replacement,<o:p></o:p></span></pre>
<pre><span lang="EN-US">all of which went smoothly.<o:p></o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US">-Bill<o:p></o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US">_______________________________________________ dns-operations<o:p></o:p></span></pre>
<pre><span lang="EN-US">mailing list <a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a> <o:p></o:p></span></pre>
<pre><span lang="EN-US"><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a> <o:p></o:p></span></pre>
<pre><span lang="EN-US">dns-operations mailing list <o:p></o:p></span></pre>
<pre><span lang="EN-US"><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><o:p></o:p></span></pre>
</blockquote>
</blockquote>
<pre><span lang="EN-US">_______________________________________________<o:p></o:p></span></pre>
<pre><span lang="EN-US">dns-operations mailing list<o:p></o:p></span></pre>
<pre><span lang="EN-US"><a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><o:p></o:p></span></pre>
<pre><span lang="EN-US"><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><o:p></o:p></span></pre>
<pre><span lang="EN-US">dns-operations mailing list<o:p></o:p></span></pre>
<pre><span lang="EN-US"><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><o:p></o:p></span></pre>
</blockquote>
<p><span lang="NL" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>