ICANN speeds up DNSSEC quantum-safety work as Category 1 gTLDs show 45% higher abuse likelihood
ICANN CTO John Crain told The Register that internet governance bodies are accelerating work to make the DNS resilient to quantum decryption. He now expects quantum-safe readiness to be needed in roughly three to five years rather than ten, citing predictions that capable machines could arrive around the turn of the decade. The main risk is to DNSSEC, which relies on PKI to authenticate DNS records. The article also covers reform of ICP-2, the document governing the five regional internet registries, and an ICANN analysis finding that regulated-sector "Category 1" gTLDs such as .bank and .pharmacy are more likely to be targeted by DNS abusers.
Detalhes técnicos
- Quantum-proofing DNSSEC with larger keys increases zone sizes, packet sizes and response sizes. This can push DNS traffic from single UDP messages to multi-packet TCP, which Crain said will take a few years to deploy predictably.
- ICANN, the IETF and other bodies have begun preliminary work on this challenge.
- Siôn Lloyd (ICANN) found that Category 1 gTLDs have a 45% higher chance of abuse than other domains, though they are less likely to show high abuse volumes.
- ICANN is working on PDP1, which would require registrars to take extra action against domains facilitating abuse, and PDP2, which would regulate automated domain registration.
- The revised ICP-2 defines four RIR lifecycle stages: recognition, audit, emergency continuity operations and derecognition. It gives ICANN an independent oversight role. NRO chair Jia-Rong Low hopes for a final document by the end of 2026.
Remediação
No specific defensive actions are given. The article indicates that DNSSEC post-quantum migration is still several years from predictable deployment.
Linha do tempo
-
ICANN speeds up DNSSEC quantum-safety work as Category 1 gTLDs show 45% higher abuse likelihood
ler a análise desta fonte ocultar
ICANN CTO John Crain told The Register that internet governance bodies are accelerating work to make the DNS resilient to quantum decryption. He now expects quantum-safe readiness to be needed in roughly three to five years rather than ten, citing predictions that capable machines could arrive around the turn of the decade. The main risk is to DNSSEC, which relies on PKI to authenticate DNS records. The article also covers reform of ICP-2, the document governing the five regional internet registries, and an ICANN analysis finding that regulated-sector "Category 1" gTLDs such as .bank and .pharmacy are more likely to be targeted by DNS abusers.
Technical Details
- Quantum-proofing DNSSEC with larger keys increases zone sizes, packet sizes and response sizes. This can push DNS traffic from single UDP messages to multi-packet TCP, which Crain said will take a few years to deploy predictably.
- ICANN, the IETF and other bodies have begun preliminary work on this challenge.
- Siôn Lloyd (ICANN) found that Category 1 gTLDs have a 45% higher chance of abuse than other domains, though they are less likely to show high abuse volumes.
- ICANN is working on PDP1, which would require registrars to take extra action against domains facilitating abuse, and PDP2, which would regulate automated domain registration.
- The revised ICP-2 defines four RIR lifecycle stages: recognition, audit, emergency continuity operations and derecognition. It gives ICANN an independent oversight role. NRO chair Jia-Rong Low hopes for a final document by the end of 2026.
Remediation
No specific defensive actions are given. The article indicates that DNSSEC post-quantum migration is still several years from predictable deployment.