Latest news of the domain name industry

Recent Posts

Chehade says “no delay” as Verisign drops a security bomb on ICANN

Kevin Murphy, March 29, 2013, 03:51:06 (UTC), Domain Policy

Verisign today said that the new gTLD program presents risks to the security of the internet, but ICANN CEO Fadi Chehade told DI that he’s not expecting any new delays.

The .com behemoth tonight delivered a scathing review of the security and stability risks of launching new gTLDs on ICANN’s current timetable.

The new Verisign report catalogs the myriad ways in which ICANN is not ready to start approving new gTLDs, and the various security problems they could cause if launched without due care.

It strongly suggests that ICANN should delay the program until its concerns are addressed.

But Chehade, in an exclusive interview with DI tonight, rebutted the already-emerging conspiracy theories and said: “There’s nothing new here that would cause me to predict a new delay.”

What does the Verisign report say?

It’s a 21-page document, and it covers a lot of ground.

The gist of it is that ICANN is rushing to launch new gTLDs without paying enough attention to the potential security and stability risks that a vast influx of new gTLDs could cause.

It covers about a dozen main points, but here are the highlights:

  • Certificate authorities and browser makers are not ready. CAs have long issued certificates for use on organizations’ internal networks. In many cases, these certs will use TLDs that only exist on that internal network. A company might have a private .mail TLD, for example, and use certs to secure those domains for its users. The CA/Browser Forum, which coordinates CAs and browser makers, has decided (pdf) to deprecate these certs, but not until October 2016. This, Verisign says, creates a “vulnerability window” of three years during which attackers could exploit clashes between certs on internal TLDs and new gTLDs.
  • Root server operators are not ready. The organizations that run the 13 DNS root servers do not currently coordinate their performance metrics, Verisign said. This makes it difficult to see what impact new gTLDs will have on root server stability. “The current inability to view the root server system’s performance as a whole presents a risk when combined with the impending delegation of the multitude of new gTLDs,” Verisign said.
  • Root zone automation isn’t done yet. ICANN, Verisign and the US Department of Commerce are responsible for adding new gTLDs to the root zone, and work on automating the “TLD add” process is not yet complete. Verisign reckons this could cause “data integrity” problems at the root.
  • The Trademark Clearinghouse is not ready. Delays in finalizing the TMCH technical specs mean registries haven’t had sufficient time to build their interfaces and test them, and the TMCH itself is a potential single point of failure with an unknown attack profile.
  • Universal acceptance of new TLDs. Verisign points out that new gTLDs won’t be immediately available to users when they go live due to lack of software support. It points specifically to the ill-maintained Public Suffix List, used by browsers to set cookie boundaries, as a potential risk factor.
  • A bunch of other stuff. The report highlights issues such as zone file access, data escrow, Whois and pre-delegation testing where Verisign reckons ICANN has not given registries enough time to prepare.

Basically, Verisign has thrown pretty much every risk factor it can think of into the document.

Some of the issues of concern have been well-discussed in the ICANN community at large, others not so much.

Yeah, yeah, but what did Fadi say?

Chehade told DI this evening that he was surprised by the report. He said he’s been briefed on its contents today and that there’s “nothing new” in it. The program is “on track”, he said.

“What is most surprising here is that there is nothing new,” he said. “I’m trying to get my finger on what is new here and I can’t find it.”

“It was very surprising to see this cornucopia of things put together,” he said. “I’m struggling to see how the Trademark Clearinghouse has a security impact, for example.”

He added that some of Verisign’s other concerns, such as the fact that the Emergency Back-End Registry Operator is not yet up and running, are confusing given that existing TLDs don’t have EBEROs.

The report could be divided into two buckets, he said: those things related to ICANN’s operational readiness and those things related to the DNS root.

“Are these operational issues really security and stability risks, and given that we can only launch TLDs when these things are done… what’s the issue there?” he said.

On the DNS root issues, he pointed to a November 2012 report, signed by Verisign, that said the root is ready to take 1,000 new gTLDs a year or 100 a week.

So the Conspiracy Theory is wrong?

ICANN timelineWhen ICANN held a webinar for new gTLD applicants earlier this week, Chehade spent an inordinate amount of time banging home the point that security and stability concerns underpin every stage of the new gTLD program’s timetable.

As this slide from his presentation (click to enlarge) illustrates, security, stability and resiliency or “SSR” is the foundation of every timing assumption.

He said during the webinar:

Nothing will trump the gTLD process, nothing, but the SSR layer. The SSR layer is paramount. It is our number one responsibility to the internet community. Nothing will be done that jeopardizes the security and stability of the internet, period.

At any time if we as a community do not believe that all relevant security and stability matters have been addressed, if we do not believe that’s the case, the program freezes, period.

There is too much riding on the DNS. Hundreds of billions of dollars of commerce. Some may say livelihoods. We will not jeopardize it, not on my watch, not during my administration.

During the webinar, I was lurking on an unofficial chat room of registries, registrars and others, where the mood at that point could be encapsulated by: “Shit, what does Chehade know that he’s not telling us?”

Most people listening to the webinar were immediately suspicious that Chehade was expecting to receive some last-minute security and stability advice and that he was preparing the ground for delay.

The Verisign report was immediately taken as confirmation that their suspicions were correct.

It seemed quite likely that ICANN knew in advance that the report was coming down the pike and was not-so-subtly readying applicants for a serious SSR discussion in Beijing a little over a week from now.

When I asked Chehade a few times whether he knew the Verisign report was coming in advance, he declined to give a straight answer.

My feeling is he probably did, though he may not have known precisely what it was going to say. The question is perhaps less relevant given what he said about its contents.

But what Chehade thinks right now is probably not the biggest concern for new gTLD applicants.

The GAC’s reaction is now critical

The Verisign document could be seen as pure GAC fodder. How the Governmental Advisory Committee reacts to the report, which was CC’d to the US Department of Commerce, is now key.

The GAC has been banging on about root system stability for years and will, in my view, lap up anything that seems to prove that it was right all along.

The GAC will raise the Verisign report with ICANN in Beijing and, if it doesn’t like what it hears, it might advise delay. GAC advice is a lot harder for ICANN’s board to ignore than a self-serving Verisign report.

What’s Verisign playing at?

So why did Verisign issue the report now? I’ve been unable to get the company on the phone at this late hour, but I’ve asked some other industry folk for their responses.

Verisign’s super-lucrative .com contract is the obvious place to start theorizing.

Even though the company has over 200 new gTLD back-end contracts — largely with dot-brand applicants — .com is its cash cow and new gTLDs are a potential threat to that business.

The company has sounded a little more aggressive — talking about enforcing its patents and refusing to comply with ICANN’s audits — since the US Department of Commerce ordered a six-year .com price freeze last November.

But Chehade would not speculate too much about Verisign’s motives.

“I can’t read why this report and why now,” Chehade said. “Especially when there’s nothing new in it. That’s not for me to figure out. It’s for me to look at this report with a critical eye and understand if there’s something we’re not addressing. If there is, and we find it, we’ll address it.”

He pointed to a flurry of phone calls and emails to his desk after the Initial Evaluation results started getting published last week for a possible reason for the report’s timing.

“I think the real change that’s happened in the last few months is that the new gTLD program is now on track and for the first time people are seeing it coming,” he said.

Competitors were more blunt.

“It’s a bloody long report,” said ARI Registry Services CEO Adrian Kinderis. “Had they put the same amount of effort into working with ICANN, we’d be a lot better off on the particular issues.”

Tagged: , , , ,

Comments (13)

  1. Rubens Kuhl says:

    CA/Browser Forum membership:
    https://www.cabforum.org/forum.html
    Look for Symantec and see the URL: http://www.verisign.com

    Could the company that bought Verisign CA business have helped a bit with CA/B position paper on internal certs ?

    You decide.

  2. Lennart Bonnevier says:

    Couldn’t ICANN, once the current bunch of new gTLDs have been accepted into the root, turn around and come back to the old ones – .com et al – and ask them to go through the same set of tests and accept the same terms as the new ones had to?

    Pure speculation of course, but Verisign might see this as a very real risk.

    • Rubens Kuhl says:

      It’s not just a risk, it’s real as of now. A currently gTLD registry, which shall remain nameless but it is not Verisign, have been already told to move to the new gTLD agreement instead of asking for changes with the current one.

  3. I like the “I’m trying to get my finger on what is new here and I can’t find it”.

    Well, it is true the issue around the protection of wine Geographical Indications does not appear on this report but maybe it is time to consider it (check public comments, check GAC EArly Warnings and recent letter sent to the board).
    This is a serious issue for the entire wine Community.
    Solutions exist: applicants won’t lose money if they are implemented.

  4. Fahd A. Batyaneh says:

    VeriSign Inc. initiated an “IDN Software Development Consortium” back in 2009, and they held sessions all around the world (Brussels, Vilnius, Amman, San Francisco, Singapore) as means to promote software development for IDN gTLDs. If VeriSign were concerned about security issues of New gTLDs, they should have developed a “New gTLD Software Consortium” to address these security issues.

    Pure lobbying as means to slow down the program, or even better if things go the wrong way, they can confirm themselves as super heroes who “told us”.

    • Tina Dam says:

      With all due respect, I do think the overall responsibility of such consortium lies with ICANN.

      I am sure that many new TLD applicants or existing gTLD registries are working to influence software adoption – just like we are at .music. We participate in application software events and have plans ready for further outreach as we get close to launch.

      However, it is difficult to imagine that one registry should carry that burden alone.

      • Fahd A. Batayneh says:

        My point was not about who should develop this consortium, but rather VeriSign’s last minute act of lobbying while in fact they could have contributed further to ensuring that the New gTLD program receives the highest levels of launch success.

        Pure politics by VeriSign Inc!

        • Tina Dam says:

          Ahh sorry, I was probably not really clear enough. I do understand the point you were making. I just thought you raised a good subject concerning outreach efforts to the software developing industry – and that this should be on the ICANN radar (it was at some point and may still be, I just did not see anything around it lately).

  5. gpmgroup says:

    At what point does ICANN have a credibility problem?

    With the exception of IDN’s the overwhelming consensus outside the domain industry is ICANN’s proposals for new gTLDs are not needed, or even sensible.

    Now we have the largest company inside the domain industry saying ICANN isn’t being very sensible.

    New gTLDs or the fear of new gTLDs is already having a damaging effect on the domain industry, with increasing government interventions, a host of new protections coming for IP together with more hurdles for innocent third parties to jump trough as ICANN tries to mitigate some of the fear from the fallout from new GTLDs.

    A quick look through the list of applications shows an alarming lack of innovation and way too much thinking along the lines of “Johnny-come-lately” speculation schemes which will end badly.

  6. DNS Snoop says:

    my guess is the answer lies in the daily “net creates” numbers for .COM and NET !

    Every day of delay just what’s more money in VeriSign’s pockets !

    A one year additional delay would put at least 30 to 50 million dollars on their bottom line !

  7. Once this community gives up the idea that there may be a pot of Gold for them in this new TLD gimmick, and really explore the truths right in front of them, then you will and I will, we all will see productive strides forward.

    10 to 1 odds Closed Monopoly TLDs are aborted.

    Gratefully, Jeff Schneider (Contact Group) (Metal Tiger)

  8. Bill says:

    Not sure how fast other gTLD holders can/will get operational .gTLD websites into the root, but currently Verisign has 1.1 million idn.com and idn.net registrations combined that are candidates to become new gTLDs, with .com and .net translated into Russian, Chinese, Japanese, Hindi, Arabic, Thai and Hebrew. Seem hardly a drop in the pond to cause any major disruption in the root servers.

Add Your Comment