<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Thanks. Your reasoning is clear, and this seems like good cryptographic key hygiene as promised in the KSK DPS.<div class=""><br class=""></div><div class="">Russ</div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 24, 2019, at 2:57 PM, David Prangnell <<a href="mailto:david.prangnell@iana.org" class="">david.prangnell@iana.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in 0in 0.0001pt;" class=""><span style="" class="">To Whom It May Concern,</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt;" class=""><span style="" class="">We have carefully reviewed the recent discussions about retaining KSK-2010 beyond its scheduled lifetime to enable a possible future as-yet-undefined technique to bootstrap a validator that has been offline for an extended period. We have decided to proceed with the deletion of the KSK-2010 as scheduled on 16 May 2019 from the Key Management Facility (KMF) East and then on 14 August 2019 from the KMF West.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt;" class=""><span style="" class="">We have made the decision based on these factors:</span><o:p class=""></o:p></div><ul type="disc" style="margin-bottom: 0in; margin-top: 0in;" class=""><li style="margin-top: 0in; margin-bottom: 0.0001pt; vertical-align: baseline;" class="">On 11 January 2019, the root zone was published with KSK-2010 marked as revoked. The KSK-2010 key was also marked as expired in the root-anchors.xml file.<o:p class=""></o:p></li><li style="margin-top: 0in; margin-bottom: 0.0001pt; vertical-align: baseline;" class="">Since 22 March 2019, the root zone is no longer published with KSK-2010 in the DNSKEY record set.<o:p class=""></o:p></li><li style="margin-top: 0in; margin-bottom: 0.0001pt; vertical-align: baseline;" class="">We have not received a strong indication of how the KSK-2010 would be used in the future.<o:p class=""></o:p></li><li style="margin-top: 0in; margin-bottom: 0.0001pt; vertical-align: baseline;" class="">It seems likely any technique to bootstrap offline validators would be implemented in software that can reasonably assumed to, at a minimum, be configured with KSK-2017.<o:p class=""></o:p></li><li style="margin-top: 0in; margin-bottom: 0.0001pt; vertical-align: baseline;" class="">Deletion of the KSK-2010 is an activity prescribed in the KSK rollover plan [1] and also in the DNSSEC Practice Statements (DPS) [2].<o:p class=""></o:p></li></ul><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt;" class=""><span style="" class="">Thank you,</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">-- <o:p class=""></o:p></span></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif; background-color: white;" class=""><span style="font-size: 11pt;" class="">David Prangnell<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif; background-color: white;" class=""><span style="font-size: 11pt;" class="">Email: <a href="mailto:david.prangnell@iana.org" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span style="color: rgb(5, 99, 193);" class="">david.prangnell@iana.org</span></a><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif; background-color: white;" class=""><span style="font-size: 11pt;" class="">IANA<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif; background-color: white;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt;" class=""><span style="" class="">[1] Page 15 at<span class="Apple-converted-space"> </span></span><a href="https://www.icann.org/en/system/files/files/ksk-rollover-operational-implementation-plan-22jul16-en.pdf" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span style="color: rgb(17, 85, 204);" class="">https://www.icann.org/en/system/files/files/ksk-rollover-operational-implementation-plan-22jul16-en.pdf</span></a><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt;" class=""><span style="" class="">[2] Section 6.5 at<span class="Apple-converted-space"> </span></span><a href="https://www.iana.org/dnssec/dps/ksk-operator/ksk-dps.txt" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span style="color: rgb(17, 85, 204);" class="">https://www.iana.org/dnssec/dps/ksk-operator/ksk-dps.txt</span></a><span style="" class=""></span><o:p class=""></o:p></div></div></div></blockquote></div><br class=""></div></body></html>