ICANN completes Key-signing-key exercise

The Internet Corporation for Assigned Names and Numbers (ICANN) has completed the key-signing-key (KSK), which is the generation of the cryptographic key to be deployed in securing the root zone of the Domain Name System using (DNSSEC) for the first time.

The exercise saw to the completion of the verification of every aspect of the equipment; software and procedures associated with the generation of the KSK to ensure correctness and trustworthy.

A press statement from ICANN informed that the ceremony was conducted with the goal of ensuring that there is widespread confidence throughout the technical Internet community that the root zone, once signed, could be relied upon to protect users from false information.

The ceremony unveiled detailed checklist with ICANN arranging for the whole system to be subject to a SysTrust audit, a process supported by the archived, unedited video footage and the legal attestations of key participants.

ICANN recalls that the KSK required considerable effort and investment, just as the body benefited from an extremely productive collaboration between staff at ICANN, VeriSign and the US Department of Commerce.

ICANN, with the help of some talented consultants, has designed processes that are thought to surpass those of many commercial Certificate Authorities not only in the degree of openness and transparency in their design and execution, but also in terms of the security engineering involved.

The design of the overall system requires ICANN to execute a ceremony like this one four times per year. The next ceremony is scheduled to take place on July 12 in El Segundo, California, where ICANN has built a second facility intended to ensure continuity for the DNS (and hence Internet users world-wide) in the event of a serious disaster in one location.

All design documentation for the ceremony will be published by ICANN, not only to promote transparency in the process for the root zone, but also to act as a valuable reference to any other organization that needs to build similar systems to support DNSSEC in top-level domains, enterprises, or anywhere else.

The deployment of DNSSEC in the root zone of the DNS will hence not only act as a catalyst for global DNSSEC deployment because of the special nature of the root zone, but also because of the design and engineering investment ICANN is giving back to the wider community.

ITREALMS Online ... delivering news for ICT4D