<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style>body{font-family:Helvetica,Arial;font-size:13px}</style>
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
Mike,</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
<br>
</div>
<div id="bloop_sign_1515457716129953024" class="bloop_sign">On January 7, 2018 at 12:53:15 PM, Michael StJohns (<a href="mailto:msj@nthpermutation.com">msj@nthpermutation.com</a>) wrote:</div>
<div>
<blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">
<span>
<div></div>
<div>
<div>> If they key gets lost or compromised, my understanding is that we cannot use RFC 5011 to do the roll and must fall back to doing an out-of-band key rollover. We aren’t really exercising this under this iteration of the community defined KSK rollover
plan.<br>
<div class="gmail_quote">
<div dir="auto"><br>
</div>
<div dir="auto">Um. No. </div>
</div>
</div>
</div>
</span></blockquote>
</div>
<p>As currently operationally practiced, I believe my statement is correct.</p>
<div>
<div>
<div>
<blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">
<span>
<div class="gmail_quote">
<div dir="auto">In fact, at this point you’re closer to being able to use 5011 as I designed it than ever before. I.e., you have two trust Anchors. </div>
</div>
</span></blockquote>
</div>
<p>And to state the obvious, the reason we’ve postponed the KSK rollover is indications that some resolvers are only configured for one trust anchor.</p>
<div>
<blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">
<span>
<div class="gmail_quote">
<div dir="auto"><span class="Apple-converted-space"> </span>If you want to be able to support key compromise and emergency replacement the next step is to add anchor C . The step after that is to revoke the current (old/original) trust anchorA. Keep C’s private
key off line and in threshold pieces. Sign the DNSKEY RRSet with B.</div>
</div>
</span></blockquote>
</div>
</div>
<p>This may be an opportunity to revise operational practice. Providing this as input may be worthwhile.</p>
<p>Regards,</p>
<p>-drc</p>
<p><br>
</p>
<div></div>
</div>
</body>
</html>