Summary
This report presents findings and recommendations regarding the selection of a cryptographic algorithm for the Domain Name System Security Extensions (DNSSEC) used in the root zone. The Internet Corporation for Assigned Names and Numbers (ICANN) is preparing to change the signing algorithm, which has been in use since 2010. The report outlines the roles of ICANN and Verisign in this process, emphasizing the importance of generating a new cryptographic key pair and distributing the new public component effectively. It discusses the operational implications of changing the algorithm, including the management of key signing keys (KSK) and zone signing keys (ZSK). The design team formed in January 2023 conducted this study to provide guidance on algorithm selection and the rollover process, while also considering the unique aspects of the DNS root zone. The document includes a comprehensive set of technical and operational recommendations aimed at assisting root zone management partners in developing a detailed implementation plan for the algorithm change.
