Los Angeles, California… The Internet Corporation for Assigned Names & Numbers (“ICANN”) today announced that the plan to change the cryptographic key that helps protect the Domain Name System (DNS) is being postponed.
The changing or “rolling” of the key was originally scheduled to occur on 11 October, but it is being delayed because some recently obtained data shows that a significant number of resolvers used by Internet Service Providers (ISPs) & Network Operators are not yet ready for the Key Rollover.
There may be multiple reasons why operators do not have the new key installed in their systems: some may not have their resolver software properly configured & a recently discovered issue in one widely used resolver program appears to not be automatically updating the key as it should, for reasons that are still being explored.
“The security, stability & resiliency of the domain name system is our core mission. We would rather proceed cautiously & reasonably, than continue with the roll on the announced date of 11 October,” said ICANN CEO Göran Marby. “It would be irresponsible to proceed with the roll after we have identified these new issues that could adversely affect a significant number of end users.”
Changing the key involves generating a new cryptographic key pair & distributing the new public component to the Domain Name System Security Extensions (DNSSEC)-validating resolvers. Based on the estimated number of Internet users who use DNSSEC validating resolvers, an estimated one-in-four global Internet users, or 750 million people, could be affected by the KSK rollover.
ICANN is reaching out to its community, Regional Internet Registries, Network Operator Groups & other people to help explore & resolve the issues.
A new date for the Key Roll has not yet been determined. ICANN’s Office of the Chief Technology Officer says it is tentatively hoping to reschedule the Key Roll for the first quarter of 2018, but it will be dependent on more fully understanding the new information & mitigating as many potential failures as possible. In the meantime, ICANN remains confident in the security of the current cryptographic key & by extension, the security of the DNS.
ICANN will provide additional information as it becomes available & the new Key Roll date will be announced as appropriate.
“It’s our hope that network operators will use this additional time period to be certain that their systems are ready for the Key Roll,” said Marby. “Our testing platform (http://go.icann.org/KSKtest) will help operators ensure that their resolvers are properly configured with the new key & we will continue our engagement and communications to these operators.”
To easily identify resources on the Internet, the underlying numerical addresses for these resources are represented by human readable strings. The conversion of these strings to numbers is done by the distributed hierarchical Domain Name System (DNS). Increased sophistication in computing & networking since its design in 1983 have made this “phone book” vulnerable to attacks. In response to these threats, the intercontinental standards organization, IETF, developed DNSSEC to cryptographically ensure DNS content cannot be modified from its source without being detected. Once fully deployed, DNSSEC will stop the attacker’s ability to redirect users using the DNS.
To keep informed about KSK Rollover developments go here: https://www.icann.org/resources/pages/ksk-rollover
On social media use: #Keyroll
# # #
Director of Communications, North America
Tel: +1 202 570 7118
Elder Manager, Latin America & Caribbean Communications
Tel: +598 95 831 442
ICANN’s mission is to help ensure a stable, secure & unified global Internet. To reach another person on the Internet, you have to type an address into your computer – a name or a number. That address has to be unique so computers know where to find each other. ICANN helps coordinate and support these unique identifiers across the globe. ICANN was formed in 1998 as a not-for-profit public-benefit corporation and a community with participants from all over the intercontinental. ICANN and its community help keep the Internet secure, stable & interoperable. It also promotes competition & develops policy for the top-level of the Internet’s naming system & facilitates the use of other unique Internet identifiers. For more information please visit: www.icann.org.