ICANN Accelerates DNS Quantum Security Efforts

Internet governance bodies are accelerating work to prepare the DNS for quantum decryption attacks. John Crain, ICANN's chief technology officer, stated that efforts within ICANN and other bodies are considering the impact of commercially available quantum computers on encrypted information. Quantum computers pose a theoretical risk to DNSSEC by potentially deciphering encrypted information. Crain changed his view on when the DNS needs to be made quantum safe after hearing predictions that quantum computers could come online at the turn of the decade. He previously estimated readiness would take ten years but now believes it may be less than that, possibly three or five years.

Using larger keys to quantum-proof DNSSEC faces challenges due to message size limits in the DNS. Larger key sizes for DNSSEC may require traffic to be carried by multiple TCP packets instead of the preferred single UDP messages. ICANN, the IETF, and other internet governance bodies have begun preliminary work to address the challenge of switching from UDP to TCP for DNSSEC. Crain stated that preparing to switch from UDP to TCP will take a few years before predictable deployment is possible.