Ursula Owusu-Ekuful – Minister of Communications
The Internet Corporation for Assigned Names and Numbers (ICANN) has indefinitely postponed the date for the changing of the cryptographic key that helps protect the Domain Name System (DNS) in Ghana and across the world.
The changing or “rolling” of the key was originally scheduled to occur on 11 October, this year, but it is being delayed because some recently obtained data shows that a significant number of resolvers used by Internet Service Providers (ISPs) and Network Operators are not yet ready for the Key Rollover, BUSINESS GUIDE gathered.
There may be multiple reasons why operators do not have the new key installed in their systems: some may not have their resolver software properly configured and a recently discovered issue in one widely used resolver programme appears to not be automatically updating the key as it should, for reasons that are still being explored, according to a statement issued by ICANN on Wednesday, October 11, 2017 to announce the postponement.
“The security, stability and resiliency of the domain name system is our core mission. “We would rather proceed cautiously and reasonably than continue with the roll on the announced date of 11 October,” said ICANN CEO Göran Marby, adding that “it would be irresponsible to proceed with the roll after we have identified these new issues that could adversely affect a significant number of end users.”
Changing the key involves generating a new cryptographic key pair and distributing the new public component to the Domain Name System Security Extensions (DNSSEC)-validating resolvers.
Based on the estimated number of Internet users, who use DNSSEC validating resolvers, an estimated one-in-four global Internet users or 750 million people could be affected by the KSK rollover.
ICANN is reaching out to its community, Regional Internet Registries, Network Operator Groups and others to help explore and resolve the issues.
A new date for the Key Roll has not yet been determined.
ICANN’s Office of the Chief Technology Officer says it is tentatively hoping to reschedule the Key Roll for the first quarter of 2018, but it will be dependent on more fully understanding the new information and mitigating as many potential failures as possible.
In the meantime, ICANN remains confident in the security of the current cryptographic key and by extension, the security of the DNS.
By Melvin Tarlue