The Reality of Algorithm Agility: Studying the DNSSEC Algorithm Life-Cycle

In this video, we present some of our findings of our paper ?The Reality of Algorithm Agility: Studying the DNSSEC Algorithm Life-Cycle?. We study the lifetime of algorithms for DNSSEC, the security extensions of the Domain Name System (DNS). This includes: (i) standardizing the algorithm, (ii) implementing support in DNS software, (iii) deploying new algorithms at domains and recursive resolvers, and (iv) replacing deprecated algorithms. Using data from more than 6.7 million signed domains and over 10,000 vantage points in the DNS, combined with qualitative studies, we show that DNSSEC has only partially achieved algorithm agility. Standardizing new algorithms and deprecating insecure ones can take years. We highlight the main barriers for getting new algorithms deployed, but also discuss success factors. Our study provides key insights to take into account when new algorithms are introduced, for example when the Internet must transition to quantum-safe public key cryptography.