SSAC Advisory on DNSSEC Key Rollover in the Root Zone (R-1)

Date IssuedDocumentReference IDCurrent Phase

  

SSAC Advisory on DNSSEC Key Rollover in the Root Zone (R-1)SAC063

CLOSED



  1. Phase 1 Receive
  2. Phase 2 Understand
  3. Phase 3 Evaluate
  4. Phase 4 Implement
  5. Phase 5 Close
  6. Closed



Description:

Internet Corporation for Assigned Names and Numbers (ICANN) staff, in coordination with the other Root Zone Management Partners (United States Department of Commerce, National Telecommunications and Information Administration (NTIA), and Verisign), should immediately undertake a significant, worldwide communications effort to publicize the root zone KSK rollover motivation and process as widely as possible.


STATUS UPDATES

DatePhaseTypeStatus Updates

 

ClosedPhase ChangeThis Advice Item is now Closed

 

Phase 5Board UpdateResolved (2021.05.12.16), the Board finds that ICANN org acted upon all Recommendations from SAC063, SAC073, and SAC102, as is evidenced by the successful first KSK Rollover. The Board considers SAC063, SAC073, and SAC102 to be completed. See full resolution at https://www.icann.org/resources/board-material/resolutions-2021-05-12-en#2.c.

 

Phase 5Phase UpdateMatt Larson sent a letter to Rod Rasmussen advising that SAC063 is complete (https://www.icann.org/en/system/files/correspondence/larson-to-rasmussen-13jan21-en.pdf). SAC063 Notes: On 11 October 2018, ICANN org carried out the first rollover of the root zone key signing key (KSK). The project is documented in Review of the 2018 DNSSEC KSK Rollover, published by ICANN’s Office of the Chief Technology Officer (OCTO). This successful rollover completed the remaining open recommendations from three SSAC Advisories: SAC063: SSAC Advisory on DNSSEC Key Rollover in the Root Zone, made five recommendations for actions to be taken by ICANN org related to the first root zone KSK rollover. SAC073: SSAC Comments on Root Zone Key Signing Key Rollover Plan, contained SSAC’s comments on the draft report of the root KSK rollover Design Team. SAC073 reiterated SSAC’s recommendations from SAC063 and called for ICANN org’s final plan to directly address each recommendation. SAC102: SSAC Comment on the Updated Plan for Continuing the Root KSK Rollover, was the response to the ICANN Board’s request that SSAC provide advice to the Board on the Plan for Continuing the Root KSK Rollover. SSAC advised continuing with the rollover.

 

Phase 5Phase UpdateOn 15 October 2018 ICANN org determined that the first-ever changing of the cryptographic key that helps protect the DNS has been completed with minimal disruption of the global Internet (https://www.icann.org/news/announcement-2018-10-15-en). The communication plan is part of the overall KSK Rollover Project. See: https://www.icann.org/resources/pages/ksk-rollover.

 

Phase 5Phase ChangeNow in Phase 5: Close

 

Phase 4Phase UpdateThe communication plan is part of the overall KSK Rollover Project. On October 11, 2018 the new KSK begins to sign the root zone key set (the actual rollover event). See: https://www.icann.org/resources/pages/ksk-rollover.

 

Phase 4Phase UpdateThe communication plan is part of the overall KSK Rollover Project. On October 11, 2017 the new KSK begins to sign the root zone key set (the actual rollover event). See: https://www.icann.org/resources/pages/ksk-rollover.

 

Phase 4Board UpdateBoard consideration is complete and implementation of advice item is ongoing. Status provided in 19 October 2016 letter from ICANN Board Chair to SSAC Chair (https://www.icann.org/en/system/files/correspondence/crocker-to-faltstrom-19oct16-en.pdf). The communication plan is part of the overall KSK Rollover Project. See https://www.icann.org/resources/pages/kskrollover. The outstanding work on this advice item will be addressed through the BAR pilot process.

 

Phase 4Phase ChangeNow in Phase 4: Implement

 

Phase 3Board UpdateResolved (2013.11.21.17), the Board acknowledges the receipt of SAC 063: SSAC Advisory on DNSSEC Key Rollover in the Root Zone. Resolved (2013.11.21.18), the Board directs ICANN's President and CEO to have the SSAC's advice from this Advisory entered into the advice tracking register and to confirm with the SSAC that the entries accurately capture the advice. Resolved (2013.11.21.19), the Board directs ICANN's President and CEO to have the advice provided in SAC063 evaluated, and to produce a recommendation to the Board regarding the acceptance of that advice, no later than 90 days from the adoption of this resolution. Resolved (2013.11.21.20), in the instances where ICANN recommends that the advice be accepted, the Board directs ICANN's President and CEO to have the feasibility and costs of implementing the advice evaluated, and to provide an implementation plan with timelines and high-level milestones for review by the Board, no later than 120 days from the adoption of this resolution. See full resolution at https://www.icann.org/resources/board-material/resolutions-2013-11-21-en#2.e.

 

Phase 1Phase UpdateSSAC published SAC063: SSAC Advisory on DNSSEC Key Rollover in the Root Zone: https://www.icann.org/en/system/files/files/sac-063-en.pdf.