Work to protect DNS from quantum decryption attacks is speeding up

Internet governance organizations are accelerating efforts to safeguard the domain name system (DNS) against potential decryption attacks from future quantum computers. John Crain, ICANN's chief technology officer, acknowledged that ICANN and other internet governance bodies are contemplating how to make DNS secure once commercially available quantum computers can easily decipher encrypted information.

These machines could theoretically pose a risk to DNSSEC, a system that verifies the authenticity of DNS records using public key infrastructure (PKI).

Crain believes the DNS may need to be made quantum-safe sooner rather than later, with estimates suggesting as little as three to five years rather than ten. One way to achieve this is by implementing larger key sizes, which would provide stronger encryption but would also increase message sizes and potentially require the use of TCP packets instead of the current UDP protocol.

ICANN, along with the Internet Engineering Task Force (IETF) and other internet governance bodies, are working on preliminary solutions to this challenge.

At ICANN's annual meeting in Bali, Jia-Rong Low, chair of the Number Resource Organization (NRO), discussed the ongoing development of Internet Coordination Policy 2 (ICP-2), which aims to cover the entire lifecycle of regional internet registries (RIRs). After controversy at AFRINIC, the NRO updated ICP-2 to include additional stages, such as emergency continuity operations and derecognition. Low expressed hope that the updated policy would be ready for review by the end of 2026.

In another session, ICANN's principal security, stability, and resiliency scientist, Siôn Lloyd, revealed that Category 1 global top-level domains (GTLDs) – such as .bank, .doctor, and .university – are more likely to be targeted by DNS abusers and have a 45% higher chance of abuse than other domains. ICANN is working on policies (PDP1 and PDP2) to address this issue, requiring registrars to take extra action against abusive domain owners and regulating automated domain registration.