Work to protect DNS from quantum decryption attacks is speeding up

Internet governance bodies are likely to accelerate work to prepare the domain name system (DNS) so it can remain secure once quantum computers can challenge conventional encryption.

John Crain, ICANN’s chief technology officer, last week told The Register that he is aware of efforts within the organization, and at other internet governance bodies, to consider what happens once commercially available quantum computers become capable of easily deciphering encrypted information.

Those machines theoretically pose a risk to DNSSEC, the Domain Name System Security Extensions that adapt PKI to the job of verifying the veracity of DNS records.

The CTO said he’s aware of predictions that such computers could come online “at the turn of the decade” and that he has therefore changed his view of when the DNS needs to be made quantum safe.

“If you asked me years ago, I would have said we probably need to be ready in ten years,” Crain said. “Now, maybe it's less than that. I don't know if it's three years or five, but it's probably not ten”.

One way to quantum-proof DNSSEC is to use larger keys that even a quantum computer will struggle to crack. Doing so, however, runs into message size limits in the DNS.

“If we go for larger key sizes, that means larger zones, larger packets, larger responses,” Crain said. It can also mean traffic being carried by multiple TCP packets, instead of the single UDP messages DNS prefers.

Crain said ICANN, the IETF, and other internet governance bodies are aware of this challenge and have begun preliminary work to address it.

“Being prepared to go from UDP to TCP is going to take a few years,” he told The Register at ICANN’s annual meeting in Bali last week. “We're probably a few years away from being able to deploy in a predictable manner.”

The internet community has, however, seen that the problem is becoming more acute.

“We're going to ramp up the speed of development,” Crain said.

Internet registry reform nears

At ICANN’s Bali conference, The Register also met Jia-Rong Low, in his capacity as chair of the Number Resource Organization, the peak body for the world’s five regional internet registries (RIRs), AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC.

The topic of that conversation was Internet Coordination Policy 2 (ICP-2), the document that governs RIRs. In its current form, ICP-2 describes the formation of a new RIR but no other part of its operations.

After strife at AFRINIC raised the possibility of the African registry failing, the NRO decided to update ICP-2 so it covered the entire lifecycle of an RIR, from formation through to possible derecognition.

Work on ICP-2 has moved through several rounds of public consultation. It has reached the status of a recommended draft. Low told The Register work on the document has proven “very challenging” to develop entirely with remote work. Last week’s ICANN meeting, he said, offered a venue for in-person collaboration that he hopes will result in work accelerating.

The revised document defines four stages in the life of an RIR: recognition, audit, emergency continuity operations, and derecognition. The last three are additions to ICP-2 and give ICANN a major role as an independent overseer of RIRs.

Low is hopeful a final document will be ready for review by the end of 2026, and ready for implementation not long afterwards.

Scammers target trustworthy-sounding domains like .bank or .pharmacy

Phisherfolk and other scammy scum strive to register authoritative-sounding domains as part of their efforts to trick victims.

ICANN defines some global top level domains (GTLDs) as “Category 1” strings, because they pertain to regulated sectors – such as .bank, .doctor, and .university – or are felt to need special safeguards because like .sucks they create the potential for bullying.

In a session at the ICANN meeting, Siôn Lloyd, ICANN’s principal security, stability and resiliency scientist, said the organization has investigated whether certain top level domains attract more abuse.

He found that Category 1 GTLDs are more likely to be targeted by DNS abusers and therefore have a 45 percent higher chance of abuse than other domains. Happily, Category 1 domains are also less likely to have high abuse volumes.

ICANN is currently working on a policy (PDP1) that will require domain registrars to take extra action against owners of domains that facilitate abuse, and another (PDP2) that will regulate automated domain registration.

More GTLDs, more often?

The Register heard plenty of chat at the meeting about ICANN’s new round of applications for GTLDs, which seems to be progressing well. Across various panels and sessions, we also heard references to ICANN’s past statements that new GTLD application rounds should be more frequent and take place at a predictable cadence, along with some suggestions that this round of applications is the template for future rounds. ®