New Security System Is Internet’s “Biggest Change In History”

Starting on 1 December, the central root zone of the internet domain name system (DNS) will be given digital signatures based on the protocol DNS Security Extensions (DNSSEC) in an effort to make the internet more secure. Once signed with DNSSEC, domains can be automatically authenticated, thereby making middle-man attacks to lure users away obvious to them. The signing of the root zone was announced by representatives of the DNS and internet security company VeriSign and the Internet Corporation for Assigned Names and Numbers at a meeting of Réseaux IP Européens (RIPE), internet address registry for the European and Middle East countries, in Lisbon this week.

VeriSign and ICANN are jointly driving the effort after a decision of the United States Department of Commerce pushing for introduction of the signatures in 2009. The root zone signing that follows the signing of several country code top-level domains like .se and generic top-level domains like .org has been labelled by VeriSign as the biggest change in the history of the DNS. Technical problems with servers using old software cannot be ruled out because answers to users’ DNS queries are considerably larger with the signatures. Therefore, the introduction of the signed root zone will be incremental, with the so-called L root server, the root server under ICANN’s control, the first to offer the signed zone to servers all over the world starting in January. It will be followed by the J and the other 11 root servers until July of next year. Only then will the controversial validation of new domain names be possible and the expected additional security in place. In the first six months of the introduction possible technical problems shall be measured.

–By Monika Ermert for Intellectual Property Watch