<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Dear colleagues,</div>
<div class=""><br class="">
</div>
<div class="">In the <a href="https://www.icann.org/en/system/files/files/plan-continuing-root-ksk-rollover-01feb18-en.pdf" class="">Plan for Continuing the Root KSK Rollover,</a> we wrote:</div>
<div class=""><br class="">
</div>
<div class="">
<blockquote type="cite" class="">ICANN org will publish monthly snapshots of the RFC 8145 trust anchor report data that we receive from several root servers.</blockquote>
</div>
<div class=""><br class="">
</div>
<div class="">Our plan is to make daily updating graphs available on a web page Real Soon Now. In the meantime, I wanted to share the latest graph of RFC8145 trust anchor report data. We're receiving data from nine root letters (A, B, C, D, F, J, K, L and M),
though the list of letters contributing has grown over time:</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">B, D and F from 2017-09-01</div>
<div class="">A/J added on 2017-12-22</div>
<div class="">H added on 2018-01-03</div>
<div class="">C added on 2018-01-04</div>
<div class="">L and M added on 2018-01-10</div>
</div>
<div class=""><br class="">
</div>
<div class="">(Thank you very much to those root operators for contributing the data!)</div>
<div class=""><br class="">
</div>
<div class="">Presumably these additions over time account for some of the jumps in the graph, but we've not (yet) made an extensive study of that. However, we do not believe the largest increase is attributable to more root letters contributing data: the recent
increases are presumably due to the release of Unbound 1.6.8 on 19 January 2018, which is a bug fix for CVE-2017-15105 (a vulnerability in the processing of wildcard synthesized NSEC records). While trust anchor signaling has been on by default in Unbound
since version 1.6.7, the need to address the vulnerability has prompted a more rapid upgrade to 1.6.8 and a corresponding increase in trust anchor reports.</div>
<div class=""><br class="">
</div>
<div class="">Burying the lede, you'll note the significant increase in the percentage of sources reporting only KSK-2010. We haven't investigated that yet, either, but we certainly will.</div>
<div class=""><br class="">
</div>
<div class="">Matt</div>
<div class=""><br class="">
</div>
<div class=""></div>
</body>
</html>