DNSSEC key rollover issues

[James Gannon]

No sorry what are the specific issues, i.e. In understanding the KSK and ZSK keys, in documentation etc? Do DNS engineers at hosting companies really not understand it?

Because there is a large amount of documentation out there for example on configuring DNSSEC in Bind and while yes deploying at scale is a risk that registrars would need to analysise and take an internal risk position on Im not sure I understand the ‘even the most experienced engineers don’t understand it’ part of the question.

The rest I do for sure, adoption of DNSSEC is a big topic, but there is huge amount son work going on in both ICANN and ISOC supporting registrars who wish to move down that path in a stable and secure path. ISOC has documentation specifically targeting at registrars http://www.internetsociety.org/deploy360/resources/dnssec-registrars/ I know the RrSG has done some work for ones that are involved in that, there is also Deplay360 from ISOC http://www.internetsociety.org/deploy360/dnssec/ and a lot of community support behind it from a technical perspective for those interested. 

My question would be what is the thing that needs to be done to promote adoption, and from what I have seen so far its usually risk aversion on the business side, and that’s not something that we can do much about from the ICANN side of things, something I feel ISOC should focus on more tho.

-J




On 26/05/2016, 11:03, "Niels ten Oever" <lists at digitaldissidents.org> wrote:

>Do you mean you would like to hear names of registrars that are not
>offering DNSSEC ? Am afraid it is the majority of the SME registrars /
>hosting providers.
>
>Cheers,
>
>Niels
>
>On 05/26/2016 11:57 AM, James Gannon wrote:
>> Have you got any specific examples?
>> 
>> 
>> 
>> 
>> On 26/05/2016, 10:50, "NCSG-Discuss on behalf of Niels ten Oever" <NCSG-DISCUSS at LISTSERV.SYR.EDU on behalf of lists at DIGITALDISSIDENTS.ORG> wrote:
>> 
>>> Hi all,
>>>
>>> I have been talking to several registrars (especially smaller ones that
>>> provide a lot of support to NGOs), that do not provide DNSSEC yet as
>>> part of their service.
>>>
>>> The story that I keep on hearing is that even the most experienced
>>> engineers have issues with understanding the configuration of the KSK
>>> and Zone signing keys and the key rollover, inconsistencies in
>>> documentation and therefore lack of adoption, because in case of a
>>> mistake this might seriously impact the production environment.
>>>
>>> I think the adoption of DNSSEC is an issue we should care about because
>>> it has the potential to radically increase trust in the DNS system.
>>>
>>> Is this an issue you all recognize, and do you know how / if ICANN makes
>>> (or can make) this easier?
>>>
>>> Best,
>>>
>>> Niels
>>>
>>>
>>> -- 
>>> Niels ten Oever
>>> Head of Digital
>>>
>>> Article 19
>>> www.article19.org
>>>
>>> PGP fingerprint    8D9F C567 BEE4 A431 56C4
>>>                   678B 08B5 A0F2 636D 68E9
>>>
>
>-- 
>Niels ten Oever
>Head of Digital
>
>Article 19
>www.article19.org
>
>PGP fingerprint    8D9F C567 BEE4 A431 56C4
>                   678B 08B5 A0F2 636D 68E9