<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Jim/Duane/all,<div class=""><br class=""></div><div class="">I apologize for the slow response to this chain but I do think it’s important for RZERC to respond to the Board resolution for a couple of reasons:</div><div class=""><br class=""></div><div class="">- First, as far as I can recall, this is the first direct request from the Board to RZERC for our advice on anything so we really do need to respond;</div><div class=""><br class=""></div><div class="">- Second, this is a real opportunity for RZERC to decide whether or not we should speak on a particular topic/question.</div><div class=""><br class=""></div><div class="">Based on our last call, I don’t think that anyone is opposed to responding to the Board’s request (the first point above) so the challenge becomes what do we think that RZERC should say (second point above)?</div><div class=""><br class=""></div><div class="">See more thoughts inline below:<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jun 18, 2018, at 3:51 PM, Jim Reid <<a href="mailto:jim@rfc1035.com" class="">jim@rfc1035.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><br class=""><br class=""><blockquote type="cite" class="">On 13 Jun 2018, at 00:47, Wessels, Duane via RZERC <<a href="mailto:rzerc@icann.org" class="">rzerc@icann.org</a>> wrote:<br class=""><br class="">As I see it, RZERC must first agree on whether or not the requested advice is within its scope. During our brief previous discussion I heard some member advocate for giving advice with specific recommendations while others felt perhaps we should politely decline.<br class=""></blockquote></div></div></blockquote><div><br class=""></div><div>I think that we’re obligated to respond but the response might provide advice or not provide any advice (for various potential reasons).</div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><blockquote type="cite" class=""><br class="">Since the timeframe is relatively short, I propose we try to reach consensus here on the list on the scope question. If we agree it is in-scope then we can use some time at our next regular meeting (Panama) to draft a response.<br class=""></blockquote><br class="">Duane/all, I’m unsure whether RZERC should comment on the planned rollover. This seems to be out of scope. IMO the proposed rollover isn’t a "major architectural change to the DNS root”. Perhaps a future KSK rollover would represent such a change if that meant moving to a different crypto algorithm (say) and/or resulted in a bigger signed response that could have a significant operational impact.<br class=""></div></div></blockquote><div><br class=""></div><div>I think that I mostly disagree with Jim’s description here (sorry Jim). I read our charter again and I think that both the first and third paragraphs of the Scope of Responsibility puts the question clearly in our scope - in particular, the portions that talk about content of the root zone (which the root KSK clearly is part of) and the "<font color="#333333" size="3" class="">security, stability or resiliency
risks to the architecture _and_operation_ of the DNS root zone.</font><font color="#333333" class=""><span style="caret-color: rgb(51, 51, 51);" class="">”</span></font><font color="#333333" size="3" class=""> (emphasis added by me). Since changing the root KSK may impact DNS users doing DNSSEC validation, I see the question from the Board is very much within the scope of our charter.</font></div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class=""><br class="">However I could be persuaded to change my mind if someone could explain why sending the board a “meh” response wouldn’t be acceptable or appropriate.<br class=""></div></div></blockquote><div><br class=""></div><div>I hope that I’ve persuaded Jim (& others :-) that the question is within our scope.</div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class="">I have asked the IAB for their comments on this topic and here’s what they have to say:<br class=""><br class=""><blockquote type="cite" class="">We've discussed it internally, and the basic message appears to be that you have to do it some time, because you'll eventually need it to get cryptographic agility, so they should proceed with all deliberate speed. Once they have done it, we think they should do it frequently enough that it isn't a huge guessing game about the state of the codebase's coverage. <br class=""><br class="">Assessing the operational readiness we didn't feel we had much particular insight into, which is why we didn't say anything out loud in response to the last white paper.<br class=""></blockquote><br class="">If RZERC does make a substantive response to the board’s request, I hope this will incorporate the IAB’s perspective above.<br class=""></div></div></blockquote><div><br class=""></div><div>The input from the IAB seems reasonable to me.</div><div><br class=""></div><div>Russ</div><br class=""><blockquote type="cite" class=""><div class=""><div class="">_______________________________________________<br class="">RZERC mailing list<br class=""><a href="mailto:RZERC@icann.org" class="">RZERC@icann.org</a><br class=""><a href="https://mm.icann.org/mailman/listinfo/rzerc" class="">https://mm.icann.org/mailman/listinfo/rzerc</a><br class=""></div></div></blockquote></div><br class=""></div></body></html>