<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div dir="auto">I just have one question:
<div dir="auto"><br>
</div>
<div dir="auto">Why change a production system almost every single internet connected device is depending on, on Friday afternoon?</div>
<div dir="auto"><br>
</div>
<div dir="auto">For half the world it was "if nobody notices I'll start an early weekend" phase.</div>
<div dir="auto"><br>
</div>
<div dir="auto">For Israel it was already in the middle of their weekend.</div>
<div dir="auto"><br>
</div>
<div dir="auto">For California it was "thanks God it's Friday, I'll quickly check things and if nobody notices I'll start an early weekend".</div>
<div dir="auto"><br>
</div>
<div dir="auto">My 2 cents.. hope nobody get hurt...</div>
<div dir="auto"><br>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">Ciao,</div>
<div dir="auto">A.</div>
<div dir="auto"><br>
</div>
<div dir="auto"><br>
</div>
</div>
<div class="x_gmail_extra"><br>
<div class="x_gmail_quote">Il 11 gen 2019 15:33, Matt Larson <matt.larson@icann.org> ha scritto:<br type="attribution">
</div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Dear colleagues,<br>
<br>
A few moments ago, at 1400 UTC today, 11 January 2019, ICANN's root zone management partner, Verisign, published root zone serial number 2019011100 with the RFC 5011 REVOKE bit set. As a result, KSK-2010's key tag has changed from 19036 to 19164. In addition,
the root DNSKEY RRset is now signed with two KSKs: the current KSK (KSK-2017) as well as the former KSK (KSK-2010). The second signature is required by RFC 5011 to prove possession of KSK-2010's private key to assert the revocation. This second signature makes
the response to a query for the root zone's DNSKEY RRset increase in size from 1414 bytes to 1425 bytes.<br>
<br>
We don't expect any operational issues from this change. The DNSKEY RRset size increase is small, and other zones currently publish considerably larger apex DNSKEY RRsets without apparent issue. In addition, because KSK-2010 has not been used for signing since
the root KSK rollover to KSK-2017 on 11 October 2018, no DNSSEC validators that are currently validating correctly can be depending on it.<br>
<br>
Nevertheless, please let us know if you suspect any issues or have any questions.<br>
<br>
May we also suggest subscribing to ksk-rollover@icann.org to receive announcements and participate in discussion about the KSK rollover process in particular and DNSSEC in the root zone in general.<br>
<br>
For the root zone management partners,<br>
<br>
Matt<br>
--<br>
Matt Larson, VP of Research<br>
ICANN Office of the CTO<br>
matt.larson@icann.org<br>
<br>
<br>
_______________________________________________<br>
dns-operations mailing list<br>
dns-operations@lists.dns-oarc.net<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
dns-operations mailing list<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
<br>
Check Point<br>
</div>
</span></font><br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
CONFIDENTIAL: This E-mail and any attachment are confidential and may contain reserved information. If you are not one of the named recipients, please notify the sender immediately. Moreover, you should not disclose the contents to any other person, or should
the information contained be used for any purpose or stored or copied in any form.<br>
</font>
</body>
</html>