ICANN83 hosted a workshop on DNSSEC security and implementation. The participants discussed development trends in the sphere of DNSSEC technologies, shared relevant research and practical cases of implementing DNS protection technologies.
The workshop once again opened with a traditional report by Eric Osterweil (Verisign), who presented updated statistics on the deployment of DNSSEC, DANE, and RPKI technologies across various domain zones, both country-code and generic. His report featured an interactive map illustrating DNSSEC implementation levels, alongside growth trends in global support for DNSSEC, DANE, and RPKI.
Chaoyi Lu (Tsinghua University) introduced a new initiative: the SSAC DNSSEC Operational Considerations Work Party, aimed to explore the practical aspects of DNSSEC deployment, identify obstacles, and analyze factors that influence its adoption.
Ondřej Surý (Internet Systems Consortium) spoke about the potential of applying post-quantum cryptographic algorithms within DNSSEC. He compared several such algorithms and outlined the anticipated challenges of implementing them in practice. His colleague, Petr Špaček, followed with an update on the development of a new RFC standard concerning the proposed DELEG resource record. This record is designed to store metadata about delegated domain spaces, such as supported protocols (UDP, TCP, TLS, QUIC) and specific name server capabilities.
Next, the seminar participants got down to discussing developments around two ongoing challenges in the DNSSEC protocol specification: DS Automation update and refining the Multi-Signer key management procedure. Steve Crocker provided a historical overview of DNSSEC’s development, highlighting foundational issues relevant to these topics. After him, Juha Suhonen (Center for Science, Finland) shared practical insights on transitioning to the ECDSA algorithm for zone signing. Shumon Huque (Salesforce) elaborated on the use of multiple DNSSEC key algorithms within multi-signature setups.
The session concluded with Felipe Barbosa (InternetNZ) sharing his case of re-architecting a multisig environment, and Johan Stenstam (Swedish Internet Foundation) addressing the complexities of managing DNS in multi-provider scenarios.
ICANN83 continues. Keep following our updates.
