Internet governance bodies are preparing faster than expected for a world where quantum computers could decrypt encrypted information, John Crain, ICANN's chief technology officer, told The Register on the sidelines of the organisation's annual meeting in Bali.
The risk concerns DNSSEC, the security extension of the Domain Name System that uses public-key cryptography to verify the authenticity of DNS records. According to Crain, predictions that commercially available quantum computers could arrive around the end of the decade have changed his view of the timeline: "Years ago I would have said we need to be ready in ten years. Now it's maybe less than that. I don't know if it's three years or five, but it's probably not ten."
Larger keys, heavier DNS
The most obvious way to make DNSSEC resistant to quantum computers is to use larger keys. The problem is that DNS has strict limits on message size. "If we go for larger key sizes, that means larger zones, larger packets, larger responses," Crain explained. In practice, a response might have to travel across several TCP packets instead of the single UDP message DNS prefers.
ICANN, the IETF and other governance bodies have already begun preliminary work on this issue. Crain expects the shift from UDP to TCP to take a few years: "We're probably a few years away from being able to deploy in a predictable manner." The work, he said, "is going to be accelerated."
Registry reform
In Bali, The Register also spoke with Jia-Rong Low, chair of the Number Resource Organization, which brings together the five regional internet registries: AFRINIC, APNIC, ARIN, LACNIC and RIPE NCC. The focus is ICP-2, the document governing RIRs. The current version describes only how a new registry is formed; the revision under way covers the whole lifecycle, from formation to possible derecognition, after the difficulties faced by AFRINIC.
The draft has been through several rounds of public consultation and is considered a recommended draft. Low expects a final text ready for review by the end of 2026. The new document defines four stages: recognition, audit, emergency continuity operations and derecognition. The last three are new and give ICANN a role as independent overseer.
Trustworthy domains, more scams
ICANN classifies some top-level domains as "Category 1" because they cover regulated sectors, such as .bank, .doctor and .university, or require special safeguards, such as .sucks, which can encourage bullying. Siôn Lloyd, ICANN's principal security scientist, presented findings showing these domains are more often targeted by DNS abuse and have a 45 percent higher chance of abuse than other domains. Their overall volume of abuse is generally lower.
The organisation is working on two policies: one (PDP1) will require registrars to act against domain owners who facilitate abuse, the other (PDP2) will regulate automated domain registration.
The meeting also discussed the next round of new global domains, which some speakers suggested could become the template for future rounds, with a more frequent and predictable cadence, as ICANN has previously recommended.
No comments yet. Be the first!