SIDN switches .nl zone from DNSSEC algorithm 8 to algorithm 13
ECDSA makes DNSSEC security faster and more efficient
This year, the .nl zone will be migrated ('rolled over') to a new algorithm for DNSSEC, the cryptographic security extension to the Domain Name System (DNS). The .nl zone will then be aligned with all the latest recommendations in this field. The rollover should have no discernible effect for registrants or end users. The new algorithm has been supported by all modern DNS servers and resolvers for some years now.
Cryptographic security
DNSSEC is a cryptographic security extension to the DNS. It involves the use of digital signatures to assure the authenticity of DNS responses.
A domain name registrant or an operator first has to sign the information (RRsets) in their zone file. Then, if asked to do so, the DNS server can attach a digital signature (in the form of an RRSIG record) to any response it sends to a query.
On receipt of a signed response, the end user (or caching resolver) can use the signature to check the authenticity of the response. That 'validation' process relies on a chain of public keys and digital signatures, which leads all the way back to the root zone: the so-called 'chain of trust'.
Recommendations
Various algorithms are available for generating the digital signatures. The international standards organisation IANA maintains a list of the algorithms in question. Over time, some established algorithms become 'deprecated' (i.e. regarded as obsolete, on account of being outdated or insecure) and new algorithms are added.
RFC 8624 now recommends using algorithm 13 (ECDSA Curve P-256 with SHA-256). For a long time, algorithm 8 (RSA/SHA-256) was the standard, but it is now slowly being phased out in favour of the ECDSA-based algorithms.
Timetable
In line with that recommendation, we intend to migrate the .nl zone from algorithm 8 to algorithm 13 in the coming weeks. The algorithm rollover will be timed so as not to interfere with the regular rollovers of ZSK pairs. The number of RRSIG records will double during the first rollover, because there is a transitional period when 2 signatures are needed for every RRset (one for each ZSK set). If another rollover were to take place on top of the algorithm rollover, that would imply at least one more set of RRSIG records, making the exercise too memory-intensive. We are currently preparing for the algorithm rollover, and have defined and published a timetable. Regular updates will be published on the same page.
As the graph below shows, algorithm 13 is now supported by almost all validating resolvers. It is highly likely, therefore, that the switch can be performed without any perceptible effect for either domain name registrants or end users. We hope and believe that the change will largely be a techno-administrative task that we perform without troubling anyone else.
Faster and more efficient
Although algorithm 8 is definitely secure at the present time, there are persuasive reasons for switching to DNSSEC algorithm 13. Algorithms 13 and 14 use ECDSA-based public-key cryptography. That has significant advantages over RSA-based cryptography (as used in algorithm 8 and certain other algorithms). With ECDSA, a similar assurance level can be obtained with much shorter keys and signatures than with RSA, and the signatures can be generated much more quickly. Only when it comes to validating the signatures is RSA (much) faster than ECDSA.
We recently published a detailed article exploring this topic. Information is also available from our DNSSEC FAQ utility.
Why not switch like us?
Switching to a more modern DNSSEC algorithm has advantages for domain name registrants and authoritative name server operators as well. RFC 8624's advice about switching from algorithm 8 (or another older algorithm) to algorithm 13 applies to DNSSEC users at all levels of the DNS. If you're a registrant or an operator, we would therefore encourage you to check which algorithm you're currently using to sign your zone(s), and, if necessary, to roll over to algorithm 13.
As the graph below shows, 58 per cent of DNSSEC-enabled .nl domain names are now using algorithm 13. The other 42 per cent are still using algorithm 8, meaning that they will have to migrate to algorithm 13 before long.
