Parts of the Internet Could Go Dark on Oct. 12 During ICANN DNS Security Key Rollover
Summary
- ICANN said some internet services could suffer disruptions on October 12 as it replaces the root zone DNSSEC key-signing key (KSK).
- The Korea Internet & Security Agency, or KISA, said it had urged domestic cache DNS operators to check whether they have applied the new cryptographic key to prepare for possible outages affecting websites, email and apps.
- KISA said the risk of a large-scale internet outage is low, but some servers running older versions could face localized access disruptions.
Forecast Trend Report by Period
News Cafe
Global Domain DNS Security Key-Signing Key Replacement
Outage Risk Is Low, but Checks Are Needed
Some internet users could find websites failing to open or online services such as email and apps not working properly on Oct. 12. The problem would occur if the Domain Name System, or DNS, cannot recognize a new security key and fails to find the correct address.
The Korea Internet & Security Agency, or KISA, said on September 7 that the Internet Corporation for Assigned Names and Numbers, or ICANN, will replace the Domain Name System Security Extensions, or DNSSEC, key-signing key, or KSK, for the root zone at 1 a.m. on October 12. KISA urged domestic operators of cache DNS servers to conduct advance checks.
DNS acts as the internet's phone book. When a user enters a web address, it finds the site's actual Internet Protocol, or IP, address and connects the user to it. DNSSEC is a technology that verifies whether address information has been forged or altered in that process. The KSK is the top-level cryptographic key that serves as the basis for that verification.
The issue lies with DNS servers that have not been updated with the new key by the time of the replacement. Servers configured to trust only the old key may fail to properly validate root zone information, causing address lookups to fail. In that case, users may see error messages such as "This site can't be reached" even when the website or server itself is operating normally. Email reception and apps that connect to external servers could also be affected.
Ordinary users do not need to take action themselves. The checks are intended for internet service providers, as well as companies and public institutions that operate cache DNS servers.
Park Jeong-seop, head of KISA's Korea Internet Information Center, said the likelihood of a large-scale internet outage is low. Still, some servers running older versions could experience localized access disruptions.
Lee Young-ae, Hankyung.com reporter 0ae@hankyung.com
Korea Economic Daily
hankyung@bloomingbit.ioThe Korea Economic Daily Global is a digital media where latest news on Korean companies, industries, and financial markets.