Cybersecurity

A consulting group (DNK LLC) report to the U.S. Department of Homeland Security stated clearly that the problems of who would own the DNSSEC keys and mistrust of the U.S. government's intentions could be barriers to DNSSEC deployment. While the August 2006 report covers developments only from March 2005 to July 2006, it makes two important points that are relevant and timely today. First it makes clear, if it weren't already, that the issue of root signing and key management has been recognized as a political issue for long time. It also offers some interesting insights on how DHS has approached the politics of DNSSEC and Internet security.

In developing the government's message about DNSSEC, DNK clearly identified barriers to adoption across several relevant interest groups, including the Internet community, the private sector, other governments and public sector actors, consumers/end users, and the media. Tellingly, “ownership of DNSSEC keys and registration” and “trust in government's [i.e., the USG] intention” were specifically identified as potential tripping points across many of the groups.

DNSSEC and the issue of signing the root have been hot topics in Internet governance over the past year. Most recently, the IGP co-sponsored workshop at IGF-Rio saw several interested parties (see the workshop writeup) vigorously debating if the root should be signed. Perhaps anticipating that discussion, ICANN released a ccNSO survey of 61 ccTLD operators on DNSSEC just before IGF-Rio. It highlighted that the majority of interviewed operators preferred ICANN/IANA sign the root, but numerous other arrangements were identified as well. In Rio, the CEO of the largest ccTLD argued that deploying DNSSEC at the root entails making a decision about whether to dedicate trust to one or multiple entities. She and a representative of CGI.br openly expressed concern about a single entity controlling such a critical piece of the DNS.

In a promising sign that policy discussions regarding critical internet resources are responding to IGP advocacy and IG Forum discussions, the DNSSEC-Deployment group is now discussing options for distributing root signing authority. This turn in the debate shows that constructive criticism and discussion of DNSSEC governance arrangements can indeed lead to improvements, despite early resistance to even discussing the topic.

[Editors note: Below is a summary of discussions which will feed into a report on the “DNSSEC: Securing a Critical Internet Resource” workshop held at IGF-Rio on November 14th.]

This informative workshop, co-sponsored by the Internet Governance Project, CGI.br, and EuroISPA, drew approximately 80-90 attendees from government, civil society, the private sector and technical communities. While the multi-stakeholder panel brought a diversity of opinions regarding DNS Security Extensions (DNSSEC), they agreed that improving the security of the Internet’s infrastructure is an important activity which should be pursued.

In general, there are two camps concerning the deployment of DNSSEC, which is a technical standard that requires coordination among many actors to be successfully deployed on a wide-scale basis. One side is ready to proceed with deployment, particularly the hurdle of creating a “trust anchor” key and digitally signing the root zone file. The other is more cautious in its approach, believing that the successful deployment of DNSSEC is subject to many open technical and governance questions.

As ICANN opened its in Los Angeles on Monday, the .uk registry released a short position paper on DNSSEC — and focused on the issue of signing the root zone. Intentionally or not, Nominet's paper validates IGP's long-held contention that there are major public policy issues around DNSSEC. In it they highlight the need for a single trust anchor and warn against alternative solutions. They emphasize the need for the keys to be managed by ICANN/IANA and used by the root zone maintainer to sign the root, and, most importantly, the necessity of opening up root management through “enhanced cooperation.”

Our 9 September blog post on DNSSEC has generated significant attention. It is gratifying to see DNS experts like Patrik Faltstrom respond. Not so gratifying is that Patrik's response reveals that even technical experts in DNS can fail to understand the governance implications of the technologies they work with daily....

Over the last few months much has been made of the digitally signing the root as a critical step in widely deploying DNSSEC. At our May Symposium on Internet Governance and Security, one panelist wondered aloud if ICANN/IANA would ever sign the root like they agreed to do in 2006. Similarly, RIPE's recent letter urged ICANN/IANA publicly to act, lest RIPE go ahead and create its own trust anchor repository as one large European ISP suggested. And finally, the FIPS requirement to deploy DNSSEC technology within medium and high impact federal IT systems is bearing down, with the effort taking on a new sense of urgency with the launch of the NIST/SPARTA/DHS SNIP testbed early this month.

Well, it now seems that some of the pressure has started to work. At the informal IEPG gathering prior to the 69th IETF being held in Chicago this week, an IANA representative explained some technical specs and operational details behind its recent deployment of a DNSSEC testbed that includes a signed root zone.

[Editors Note: Apologies for the belated writeup of an informative panel discussion on the implications of DNSSEC deployment and signing the root.]

“If you hold the [DNSSEC] keys you can decide who is the root zone file editor and who are the root servers. You hold the keys to the Internet kingdom.” – Paul Vixie

On May 17, 2007, IGP, George Mason University Law School's Critical Infrastructure Protection Program and the EPFL eGov program hosted a panel on DNS Security Extensions (DNSSEC) at the Swiss Embassy in Washington DC. Several recognized technical experts from the private sector, ICANN and the US government discussed the deployment of DNSSEC, and in particular the policy dimensions of digitally signing the Internet’s root zone file. The audience of nearly 80 people included Department of Commerce officials, US government contractors, policy-makers, public-interest advocates and graduate students.  Moderated by Brenden Kuerbis of the Internet Governance Project, the panel included Paul Vixie (ISC), David Conrad (IANA), Scott Rose (US Department of Commerce-NIST), Matt Larson (VeriSign), and Thierry Moreau (Connotech). The discussion highlighted major technical challenges facing DNSSEC deployment, and the effects of root signing on tld zone operators and the Internet’s Domain Name System (DNS).

The European IP address registry, RIPE, has formulated a formal request to ICANN to sign the DNS root as soon as possible. This proposition obtained unanimous support from RIPE members. A formal letter of request was sent to ICANN June 12. You can view the letterand the statement at this...