Summary

  • SeCIU replaced the hardware security module for .uy and generated DNSSEC keys at an October 15 ceremony witnessed by technical institutions and a notary.
  • ICANN says one new key set is for an algorithm planned for later. IANA’s current .uy delegation entry still lists a single DS record with algorithm 8, so the public parent record has not announced that future algorithm.

A sealed key in a room in Montevideo cannot, by itself, change what the rest of the Internet trusts. On October 15, SeCIU replaced the hardware security module and renewed DNSSEC keys for Uruguay’s .uy domain, according to its own notice. A university legal office certified the process; witnesses included ICANN, LACNIC and national operators. This was the second renewal since .uy adopted DNSSEC in 2015. The ceremony gave the new keys a controlled origin. It did not publish a deployment schedule.

ICANN’s witness account adds the interesting fork. SeCIU generated key-signing keys for the current cryptographic algorithm and for another algorithm it plans to introduce in coming months. ICANN does not name the future algorithm or a launch date. The public IANA .uy delegation record, checked for this article on November 3, still shows one DS entry: key tag 19730, algorithm 8, digest type 2. The record says it was last updated on August 7. That is the parent-side trust anchor a validating resolver can find in the root today; it is not a photograph of every key stored inside SeCIU’s new module.

The distinction is the whole operating story. A key can be generated and guarded long before it signs a live zone. For an algorithm transition, the .uy zone, its signatures and the parent DS have to line up while resolvers can still validate the old chain. A mistimed handoff can make signed names fail validation even if each key was created perfectly. The published accounts give the ceremony and the current root entry; they do not give the overlap plan, future algorithm number or date of the parent update. Those are the facts that would turn preparation into an operating change.

The October 11 root-zone KSK rollover was a separate event, as ICANN notes. Treating the two ceremonies as one grand switch would miss where SeCIU actually holds the levers: inside the HSM, in the .uy zone, and at the request that eventually changes the root’s DS. The next line to watch is not another photograph of a sealed envelope. It is the dated root delegation update and a clean validation path across the transition.