Latest news of the domain name industry

Recent Posts

Set buttocks to clench! ICANN approves risky KSK rollover

Kevin Murphy, September 17, 2018, 10:16:10 (UTC), Domain Policy

ICANN has approved the first rollover of the domain name system’s master security key, setting the clock ticking on a change that could cause internet access issues for millions.
The so-called KSK rollover, when ICANN deletes the key-signing key that has been used as the trust anchor for the DNSSEC ecosystem since 2011 and replaces it with the new one — will now go ahead as planned on October 11.
The decision was made yesterday at the ICANN board of directors’ retreat in Brussels.
ICANN chief technology officer David Conrad posted this to an ICANN mailing list this morning:

The Board voted to approve the resolution for ICANN org to move forward with the revised KSK rollover plan. So barring unforeseen circumstances, the KSK-2017-signed ZSK will be used to sign the root zone on 11 October 2018.

The rollover was due to happen October 11 last year, but ICANN delayed it when it emerged that many DNS resolvers weren’t yet configured to use the new key.
That’s still a problem, and nobody knows for sure how many endpoints will stop functioning properly when the new KSK goes solo.
While most experts weighing in on the rollover, including Conrad, agreed that the risk of more delay outweighed the risk of rolling now, that feeling was not unanimous.
Five members of the 22-member Security and Stability Advisory Committee — including top guys from Google and Verisign — last month dissented from the majority view and said ICANN should delay again.
The question now is not whether internet users will see a disruption in the days following October 11, but how many users will be affected and how serious their disruptions will be.
Based on current information, as many as two million internet users could be affected.
ICANN is likely to take flak for even relatively minor disruptions, but the alternative was to continue with the delays and risk an even bigger impact, and even more flak, in future.
The text of ICANN’s resolution and the rationale behind it will be published in the next day or so.

Tagged: , , , , ,

Comments (2)

  1. Avri Doria says:
    September 18, 2018 at 1:32 pm

    My dissenting vote statement on the KSK rollover vote can be found at:
    https://docs.google.com/document/d/1kKXQ1OcdUt-O5QQc-6b509mW16yG_ybv7O3YbyYaKi8/edit?usp=sharing

    Reply
  2. AC says:
    October 14, 2018 at 6:38 am

    I was wondering why we have been having DNS failures for the past few days.
    Mystery solved.

    Reply

Add Your Comment