<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=EN-US link="#467886" vlink="#96607D" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt'>Hi Will,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Andres and I perform the same role, and I can answer your questions as well. Please see responses in line:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal>>COs will be given a full set of iKeys.<br>>RKSHs will only be given Domain and CO cards<br>>Domain cards will be 5 out of 7<br>>All other cards will be 3 out of 7<br>>The backup will now be on a different HSM<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This is correct. The backups are on a dedicated backup HSM. They appear identical to the standard HSMs, but have a different firmware to be clear.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>>In my first email I asked the question:<br><span style='color:black'>>What credentials will be required to apply existing cards to a new HSM?<br>>by this I was referring to transferring the new credentials (Domain, Audit, CO, SO) between all of the different Thales Luna HSMs <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>During the initial setup of an HSM one is prompted to create a new set of credentials or import an existing set of credentials. If one opts to import an existing set of credentials, the HSM requires the M in the M of N (either 3 or 5 depending on the credential in question here) to be inserted into the HSM, and with that, the import is complete. On Day 2 we plan to configure the first HSM and generate all of the credential sets that are required, clone the individual credentials until we have what is required for distribution to all TCRs, and then import these credentials to the remaining HSMs to be configured that day.<br><br>We have 2 Luna G7 signing HSMs and 2 Luna G7 backup HSMs for testing in our possession and have performed test scenarios on the hardware to ensure our logic is sound. This coupled with the Thales documentation allows us to ensure accuracy with the ceremony scripts.<br><br>>In your reply to Micha you state that new HSMs are to be added every two to three years. However looking at the previous scripts quite a few of the recent ones involve new HSMs. Is this just to do with the lifecycle of the originals?<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>In recent ceremonies we introduced new Keyper HSMs to replace aging units (HSMs 5 and 6 for both KMFs) to ensure their lifecycles would exceed the remaining lifecycle of the current KSK-2017. This will allow us a lengthy pre-publication period of the KSK-2024 slated for generation this April on the new equipment before the rollover date scheduled in 2026. You may read more about the key rollover phases here: <a href="https://www.icann.org/en/system/files/files/proposal-future-rz-ksk-rollovers-01nov19-en.pdf">https://www.icann.org/en/system/files/files/proposal-future-rz-ksk-rollovers-01nov19-en.pdf</a></span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The plan with Luna HSMs Is to align the lifecycle of the signing HSMs with the lifecycle of the KSKs they contain. Additionally, we plan to introduce additional backup HSMs approximately midway through a key’s lifecycle so we’ll have backup HSMs manufactured at different times going forward. This plan provides the 2-3 year cadence Andres previously mentioned. <span style='color:black'><br><br>>Finally I notice that KSK Ceremony 53 is split into two parts. Will the second part (Introducing the new HSMs) be live streamed the same way as the normal ceremony?<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>Yes. We have separate ceremony pages set up for the two ceremony days, and each will have its own embedded YouTube livestream link. Each day will have its own annotated script and ceremony artefacts posted afterward as is customary.<br><br>>I apologise for all the questions but it doesn't help that I only started learning about DNSSEC and the KSK about 3 months ago.<br><br>It sounds like you’re off to a great start. We don’t mind the questions. Our goal is to promote awareness and trust in the process, so we are here to serve that purpose.<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>-Aaron</span><br><br> <span style='font-size:11.0pt'><o:p></o:p></span></p><div><div><div><p class=MsoNormal><o:p> </o:p></p></div></div></div></div></body></html>