KISA requests cache DNS operating agency to inspect… The likelihood of large-scale failure is low

KISA requests cache DNS operating agency to inspect… The likelihood of large-scale failure is low

(Seoul = Yonhap News) Reporter Kwon Ha-young = As the international domain security encryption key is replaced next month, domestic cache Domain Name System (DNS) server operators must begin preliminary inspection.

The Korea Internet & Security Agency (KISA) announced on the 7th that as the Internet Corporation for Assigned Names and Numbers (ICANN) will replace the Domain Name System Security Extensions (DNSSEC) Key Signature Key (KSK) of the root zone at 1 a.m. on the 12th of next month (Korea Standard Time), it is asking domestic cache DNS server operators to conduct a preliminary inspection.

Cache DNS is a system that finds and connects to the actual Internet address (IP address) when an Internet user enters a domain name.

The top-level information required for address search is provided in the root zone, and the root zone contains top-level domain information such as dotKR (.kr) and dotcom (.com).

DNSSEC is a technology that verifies that this information has not been forged or altered, and KSK is an encryption key that serves as a standard of trust in this verification.

ICANN periodically replaces KSK to maintain root zone security. This replacement is the second since DNSSEC was first applied to the root zone in 2010.

The new encryption key has been used along with the existing encryption key since January of last year, and from the 12th of next month, only the new encryption key will be used for root zone signing.

Cache DNS that does not reflect the new encryption key until the time of replacement will fail to look up all domain addresses within approximately 48 hours, and users of the corresponding DNS server will not be able to access Internet services.

Accordingly, cache DNS operating organizations such as Internet Service Providers (ISPs) must check in advance whether the new encryption key is reflected.

Park Jeong-seop, head of KISA's Korea Internet Information Center, said, "Approximately 95% of the world has already reflected the new encryption key, so it is unlikely that a large-scale Internet failure will occur. However, localized Internet access failures may occur on some servers that use older versions or do not automatically renew properly, so please be sure to check in advance."