The cryptographic key pairs that secure the web is being changed for the very first time in its life.
The U.S.-based Internet Corporation for Assigned Names and Numbers (ICANN) wants to change the key pair that creates the first link in a long chain of cryptographic trust that lies beneath Domain Name System (DNS). The key pair is what ensures web users to visit the correct website when type its URL.
"ICANN wants to be very transparent in the operation of this key because it's important that the community trusts it," said Matt Larson, VP of research at ICANN.
DNS translates to domain names to numerical IP addresses so computers can visit them. But DNS wasn't built with security in mind - it was designed to make the internet a friendlier place. According to Larson, "there wasn't much thought of putting security into it."
As a result, DNS is vulnerable to cache poisoning and spoofing. This is where a server that does the phonebook-like lookups is forced to return an incorrect IP address. When this happens, the traffic of a website can be directed to somewhere else, such as malicious websites controlled by hackers.
To secure the traffic, many domains use DNS Security Extensions (DNSSEC). With it, crypto keys are used to authenticate that the DNS data is coming from the correct place. So if the signature between them doesn't line up, the browser will send an error instead of sending the user to the wrong website.
The key pair at the top of this chain, is called the Root Zone Signing Key. This is what ICANN is changing for the first time.
"We want to roll the key because it's good cryptographic hygiene," Larson added. Switching the key pair also allows ICANN to increase the size of the key switch, from 1024 bits to 2048 bits.
