ICANN 87: DNS quantum prep, RIR reform, and domain abuse trends

ICANN's chief technology officer has cut his estimate of how long the domain name system has before quantum computers can break the encryption it relies on, from about a decade to three or five years. Speaking to The Register at ICANN 87 in Bali, John Crain said work to make DNSSEC quantum-safe is likely to accelerate, although moving DNS from UDP to TCP will take years on its own.

Quantum-safe DNS work accelerates

John Crain, ICANN's chief technology officer, told The Register that internet governance bodies are likely to accelerate work to prepare the domain name system for quantum computers that can challenge conventional encryption. He said such machines could become commercially available "at the turn of the decade," and that his view of the timeline has changed from about ten years to perhaps less than that, maybe three or five years.

Those machines could threaten DNSSEC, which uses public key infrastructure to verify DNS records. One way to quantum-proof DNSSEC is to use larger keys, but that increases message sizes and can push traffic from single UDP messages to multiple TCP packets. Crain said ICANN, the IETF, and other bodies are aware of the challenge and have begun preliminary work. Being prepared to move from UDP to TCP will take a few years, and predictable deployment is probably a few years away. "We're going to ramp up the speed of development," Crain said.

RIR governance reform nears

At the same meeting, The Register met Jia-Rong Low, chair of the Number Resource Organization, the peak body for AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC. The discussion concerned Internet Coordination Policy 2, the document governing regional internet registries. Its current form describes the formation of a new RIR but no other part of its operations.

After strife at AFRINIC raised the possibility of the African registry failing, the NRO decided to update ICP-2 to cover an RIR's entire lifecycle, from formation through possible derecognition. The work has moved through several rounds of public consultation and reached recommended draft status. Low said developing it entirely with remote work has been "very challenging," and he hopes in-person collaboration in Bali will accelerate it.

The revised document defines four stages: recognition, audit, emergency continuity operations, and derecognition. The last three are additions and give ICANN a major role as an independent overseer of RIRs. Low is hopeful a final document will be ready for review by the end of 2026 and ready for implementation not long afterwards.

Category 1 domains attract abuse

ICANN defines some global top level domains as "Category 1" strings because they pertain to regulated sectors, such as .bank, .doctor, and .university, or need special safeguards, such as .sucks, which creates potential for bullying. Siôn Lloyd, ICANN's principal security, stability and resiliency scientist, said the organization investigated whether certain top level domains attract more abuse.

Category 1 gTLDs are more likely to be targeted by DNS abusers and have a 45 percent higher chance of abuse than other domains. Happily, Category 1 domains are also less likely to have high abuse volumes. ICANN is working on a policy that will require registrars to take extra action against owners of domains that facilitate abuse, and another that will regulate automated domain registration.

New gTLD round progresses

The Register heard plenty of chat at the meeting about ICANN's new round of applications for gTLDs, which seems to be progressing well. Across panels and sessions, there were references to ICANN's past statements that new gTLD application rounds should be more frequent and take place at a predictable cadence, along with suggestions that this round is the template for future rounds.

Sources: The Register