New Internet domain names will add wrinkles, but how much risk?

The recent decision to expand the number of generic top-level domains used in online addresses should have little impact on the task of securing the Domain Name System that underlies Internet activity, industry and government experts say.

“I don’t think there are any technical concerns with that,” said Doug Montgomery, manager of the National Institute for Standards and Technology's Internet and Scalable Systems Metrology Group.

The security tools and processes already in place with the current 22 generic TLDs should serve as well under an expanded naming system, although the added volume and complexity could present some challenges to the good guys and opportunities for the bad guys. Potential problems could include misuse of some existing digital certificates, difficulties in translating Internationalized Domain Names and the possibility of using new domains for spoofing.

Related stories:

ICANN approves plan to add brand-name domains

DHS' guide to managing Domain Name System risks

“We have the ability to protect ourselves,” said Jon Geater, director of technical strategy for Thales e-Security. “We’ll have to see how it shakes out.”

The Internet Corporation for Assigned Names and Numbers announced June 20 that it had approved a plan to expand the number of generic TLDs and would begin accepting applications early next year.

Domain names are the easy-to-read names, separated by dots, that are used in URLs on the Web and in e-mail addresses, and which are associated with numerical IP addresses for routing data over the Internet. There currently are 22 generic TLDs, such as .com and .gov, and about 250 country code TLDs, such as .us. The decision by ICANN will open the Domain Names System to an unlimited number of new generic TLDs, up to 1,000 a year, in not only ASCII or Latin script, but also in any other script, such as Arabic or Chinese.

The approval process could take from nine to 20 months, so the first new TLDs probably will not begin appearing after the final dot in URLs until early 2013 at the soonest.

Because it underlies almost every Internet transaction, the Domain Name System has been identified as a critical IT function by the Homeland Security Department, which recently released a report detailing the most serious risks to the system.

One of the threats identified in the report is the fragmentation of the Internet by breaking up the single root zone that now underlies the DNS with the creation of alternate roots by individual nations, which “would have significant implications to international trade since the global free flow of electronic information would be hampered,” the report states.

A recommendation for avoiding such fragmentation is the use of Internationalized Domain Names that would allow communities that do not use the Latin alphabet to use their own languages and scripts in domain names. ICANN has approved 13 country and territory applications in the evaluation phase, and several IDN strings have entered into the root zone.

“The decision to allow any script is interesting,” Geater said. “Formalizing that will potentially be a big difference.”

VeriSign, which operates the .com and .net registries, has about 1 million internationalized domain names in its databases, although they are not top-level names, said Pat Kane, VeriSign’s general manager of naming services.

The DNS handles domain names in ASCII, a character encoding system for rendering the English alphabet, and Internationalized Domain Names are converted to and from ASCII between domain name servers and browsers.

“IDN are second-class domains now because they don’t render the way they are expected sometimes in browsers,” Kane said. “The user interface does not have the same standardization” as the conversion technology used in DNS, he said.

But the roll-out of new domain names is likely to come gradually, giving vendors time to adapt to new scripts. “As long as you are on a maintained platform, they would have time to adjust their behavior,” Montgomery said.

A key element in securing DNS is the use of DNS Security Extensions, a set of protocols to allow digital signing of DNS records. Expanding the number of TLDs should not interfere with the use of DNSSEC, Montgomery said.

“They are still domains under the root,” which already has been signed, he said. “They will still be signed under the root” and use the same trust anchor.

But new registries will have to implement DNSSEC and digitally sign records. Failure to do this could open new opportunities for forging addresses or misdirecting traffic. But, on the other hand, “the scope of the attack is smaller,” Geater said.

One issue that Montgomery raised is the misuse of Secure Sockets Layer certificates issued to verify name strings that could look like top-level domains but which are intended for internal use and are outside the DNS. If such a string eventually becomes a TLD, the certificate could be used to falsely verify an address. But that would be a limited situation.

Because of the $185,000 price tag for applying and the lengthy approval process, Montgomery said he does not expect a flood of new generic TLDs.

“I don’t think this is suddenly going to create a land rush for new domains,” he said. “I think it will be a blip.”