On 11 October ICANN achieved its first-ever changing of the cryptographic key that helps protect the Domain Name System (DNS) with minimal disruption. It was the first time the key has been changed since it was first put in use in 2010.
The changing of the cryptographic key, or rolling the root zone Key Signing Key, also known as KSK Rollover, was originally scheduled for October 2017. But fears surfaced that as many as one in 4 internet users could have lost internet access. The rolling of the KSK Key was originally delayed because some data obtained just a couple of weeks before the originally scheduled date showed that a significant number of resolvers used by Internet Service Providers (ISPs) and Network Operators were not yet ready for the Key Rollover. The availability of the new data was due to a very recent DNS protocol feature that adds the ability for a resolver to report back to the root servers which keys it has configured.
During the Key Rollover last week the few issues that arose appear to have been quickly mitigated and none suggested a systemic failure that would approach the threshold (as defined by the ICANN community) to initiate a reversal of the roll. In that context, ICANN has said it appears the rollover to the new Key Signing Key, known as KSK 2017, has been a success.
At this point, there are no indications it is necessary to back out of the rollover and ICANN will now proceed to the next step in the rollover process: revoking the old KSK, known as KSK 2010 during the next key ceremony in the first quarter of 2019.
“This successful exercise of the infrastructure necessary to roll the root zone’s key has demonstrated it is possible to update the key globally,” said David Conrad, ICANN’s Chief Technology Officer. “It also provided important insights that will help us with future key rolls.”
The final decision to roll the root zone Key Signing Key (KSK) was made by ICANN President and CEO Göran Marby after reviewing the outcomes of the efforts of ICANN and others, particularly in the DNS technical community. These outcomes were the result of significant global outreach efforts, in consultation with the ICANN community, and after extensive analysis of available data.
