<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<font face="Courier New" class="">Dear colleagues,</font>
<div class=""><font face="Courier New" class=""><br class="">
</font></div>
<div class=""><font face="Courier New" class="">I recently wrote an update on the root KSK roll project at <a href="https://www.icann.org/news/blog/update-on-the-root-ksk-roll-project" class="">https://www.icann.org/news/blog/update-on-the-root-ksk-roll-project</a>.
The text is reproduced below for your convenience.</font></div>
<div class=""><font face="Courier New" class=""><br class="">
</font></div>
<div class=""><font face="Courier New" class="">Matt</font></div>
<div class=""><font face="Courier New" class="">--<br class="">
Matt Larson <<a href="mailto:matt.larson@icann.org" class="">matt.larson@icann.org</a>><br class="">
VP of Research, Office of the CTO, ICANN</font><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<p style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif;" class="">
This post is the first in an ongoing series of updates on the status of the root KSK roll project. We intend to keep the community updated on our efforts to proceed with the rollover.</p>
<p style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif;" class="">
On 27 September 2017, the <span class="">ICANN</span><span class=""> </span><span class="">org</span> <a href="https://www.icann.org/news/announcement-2017-09-27-en" style="box-sizing: border-box; color: rgb(0, 152, 213); text-decoration: none;" class="">announced</a> we
were postponing the root zone KSK roll. More recently, on 17 October we published a paper entitled <a href="https://www.icann.org/en/system/files/files/root-ksk-roll-postponed-17oct17-en.pdf" style="box-sizing: border-box; color: rgb(0, 152, 213); text-decoration: none;" class=""><em style="box-sizing: border-box;" class="">Postponing
the Root KSK Roll</em></a> that gives further details on the information we received on the configuration of some resolvers that influenced the decision, our analysis, and our reasoning behind the postponement.</p>
<p style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif;" class="">
As we described in that <a href="https://www.icann.org/en/system/files/files/root-ksk-roll-postponed-17oct17-en.pdf" style="box-sizing: border-box; color: rgb(0, 152, 213); text-decoration: none;" class="">paper</a>, the most recent versions of the <span class="">BIND</span><span class=""> </span><span class="">and
Unbound recursive resolvers implement a protocol defined in</span> <a href="https://www.rfc-editor.org/rfc/rfc8145.txt" style="box-sizing: border-box; color: rgb(0, 152, 213); text-decoration: none;" class=""><abbr title="Request for Comments" class="" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s;">RFC</abbr> 8145</a>, <em style="box-sizing: border-box;" class="">Signaling
Trust Anchor Knowledge in <abbr title="Domain Name System" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s;" class="">DNS</abbr> <span class="">Security </span><span class="">Extensions
(</span><span class="">DNSSEC</span><span class="">)</span></em>, that allows a resolver to report its trust anchor configuration. A resolver supporting this feature reports its configured trust anchors for the root zone to the root name servers. Analysis
of this reported trust anchor data, in the weeks leading up to the previously scheduled rollover date of 11 October 2017, led to concerns that there could be a larger than anticipated population of resolvers not configured with KSK-2017 (our shorthand for
the next root zone KSK) as a trust anchor. Those resolvers will be unable to resolve <abbr title="Domain Name System" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s;" class="">DNS</abbr> queries
when the rollover occurs.</p>
<p style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif;" class="">
The Research group in the Office of the CTO (OCTO) analyzed traffic to the B, D, F and L root servers for the entire month of September 2017 and found 11,982 unique <span class="">IP</span><span class=""> </span><span class="">addresses (8,908 IPv4 and 3,078
IPv6) sending trust anchor configuration information. Of those, 620 addresses reported being configured with only KSK-2010 (the shorthand for the current root zone KSK). Upon further analysis, we were able to eliminate some false positives:</span> <span class="">IP</span><span class=""> </span><span class="">addresses
that, for various reasons, did not represent recursive resolvers performing</span> <span class="">DNSSEC</span><span class=""> </span><span class="">validation. We reduced the list to 500 addresses of possible misconfigured recursive resolvers whose operators
we would like to contact. We have two main reasons for wanting to reach them: to understand the reason their resolver reports being configured with only KSK-2010 and, if appropriate, to help them correct the configuration to be prepared for the rollover.</span></p>
<p style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif;" class="">
We had initially planned to make this list of addresses public to enlist the community's help. Upon further reflection, we realized that such a list could be taken out of context as an attempt to "name and shame" operators with misconfigured systems, which
is not our intent at all. We've decided to make an initial attempt to contact the administrators ourselves. Depending on the outcome, we might need to publish the list of addresses whose administrators we are unable to reach.</p>
<p style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif;" class="">
According to the data from September mentioned above, 4.1% of <span class="">IP</span><span class=""> </span><span class="">addresses report only KSK-2010. (The actual percentage of all resolvers on the Internet with only KSK-2010 might likely be higher, since
only a very small number currently report trust anchor configuration.) We want to make a significant improvement in that number through our investigation and mitigation. Since we don't know how many administrators we'll be able to contact, we don't want to
set a target percentage just yet.</span></p>
<p style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif;" class="">
It's important to note that the value represents a percentage of resolvers, not end users, and the impact on end users is what's most important. The criteria in the <a href="https://www.icann.org/en/system/files/files/ksk-rollover-operational-implementation-plan-22jul16-en.pdf" style="box-sizing: border-box; color: rgb(0, 152, 213); text-decoration: none;" class="">published
operational plan</a> for backing out of the rollover in the event of problems references the effect on end users:</p>
<p style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif;" class="">
<em style="box-sizing: border-box;" class=""><abbr title="Internet Corporation for Assigned Names and Numbers" style="box-sizing: border-box; unicode-bidi: bidi-override; direction: ltr; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(153, 153, 153); cursor: help; transition: all 0.2s;" class="">ICANN</abbr> will
consider back out of any step in the key roll process if the measurement program indicates a considerable amount of the estimated Internet end-user population has been negatively impacted by the change 72 hours after each change has been deployed into the
root zone.</em></p>
<p style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif;" class="">
These criteria were derived in part from the recommendations of the root KSK roll design team that <span class="">ICANN</span><span class=""> </span><span class="">convened to help plan the rollover, whose</span> <a href="https://www.iana.org/reports/2016/root-ksk-rollover-design-20160307.pdf" style="box-sizing: border-box; color: rgb(0, 152, 213); text-decoration: none;" class="">report</a> includes
this recommendation that also centers on end users:</p>
<p style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif;" class="">
<em style="box-sizing: border-box;" class="">Recommendation 16: Rollback of any step in the key roll process should be initiated if the measurement program indicated that a minimum of 0.5% of the estimated Internet end-user population has been negatively impacted
by the change 72 hours after each change has been deployed into the root zone.</em></p>
<p style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif;" class="">
Throughout this process, we will consider the end-user impact a more important consideration than the absolute percentage of resolvers that still report only KSK-2010. After we've contacted as many resolver operators as we can, we'll attempt to determine the
number of end users affected by the remaining resolvers not yet reporting KSK-2017. Determining the number of end users that use a particular resolver is difficult, but we have several ideas and sources of data to help with this task.</p>
<p style="box-sizing: border-box; line-height: 1.4rem; font-size: 16px; margin: 0px 0px 1.25rem; color: rgb(51, 51, 51); font-family: helvetica, arial, sans-serif;" class="">
We'll report more on these efforts and other developments in future blog posts as we keep the community updated on our progress.</p>
</div>
</body>
</html>