From Verification to Trust: Refreshing the Security Status Quo

• By • Security

Digital signatures, introduced by Whitfield Diffie and Martin E. Hellman in 1976’s “New Directions in Cryptography,” have provided the cornerstone of the internet’s cybersecurity apparatus for decades. Every moment of every day, behind the scenes of nearly every secure online interaction, these signatures enable critical trust decisions made across the globe. As the threat landscape accelerates — with AI and quantum threats challenging the status quo — there is a growing need to focus on current security status when signatures are used, making the transition from verification to trust.

(more…)

Introducing Verisign Informed™: A High-Assurance Solution for Validating Trust at the Speed of Modern Threats

• By • Security

New technology is accelerating global reliance on digital infrastructure, yet also enabling and surfacing new security threats. Among these is “stale trust,” in which critical trust decisions are made based on out-of-date validation information. Verisign Informed™ addresses this problem by enabling trust decisions to be made using current status information for any digital certificate transaction, reducing online and enterprise risk.

There are two clear trends that together present significant risks to online commerce, privacy, and security. The first is a perennial and increasing reliance on digital services, and this reliance is increasing rapidly with the growing use of AI. We see this increasing reliance in the rapid growth of transactions in the DNS infrastructure we operate. Over the 7-year period 2016-2022, the average number of daily DNS transactions Verisign processed rose by a compound annual growth rate of 9.3 percent; in the 3-year period 2023-2025, the compound rate nearly doubled to 17.3 percent. Our analyses indicate that an increasing segment of this growth is driven by rapid AI deployment.

(more…)
Digital blue and purple pathways intersect and overlap.

Proposed New DNS Resource Record Types for AI Agent Discovery

• By • Security

This blog post is based on a paper titled “Efficient and Secure Discovery for AI Agents: The Case for DNS,” authored by Ramachandra Rao Seethiraju, Sameer Thakar, Karthik Shyamsunder, and Eric Osterweil. This blog was co-authored by all four authors.

For more than three decades, domain names have served as a foundational identity layer for internet applications. Initially used to identify early network services such as TELNET, FTP, and email, they later became essential to web browsing and a growing range of online services. Their enduring value lies in their ability to provide unique, stable, neutral, and widely recognized identifiers across changing technologies and use cases.

(more…)
Close-up of a circuit board with glowing blue and orange pathways.

The 2024-2026 Root Zone KSK Rollover: Updates and Observations

• By • Security

This blog post is co-authored by Duane Wessels (Verisign) and Roy Arends (ICANN).

Roughly a year and a half ago, Verisign and the Internet Corporation for Assigned Names and Numbers (ICANN) began the important, multi-year process of updating the cryptographic key that secures the authoritative Domain Name System (DNS) root zone. This work has been largely invisible to the public, but vital to the security of many everyday online activities.

(more…)

Preparing DNSSEC for the Post-Quantum Era

• By • Security

The Domain Name System Security Extensions (DNSSEC) help protect the integrity of DNS data, supporting both online navigation and other uses of domain names as identifiers in applications. In the time since DNSSEC was first introduced in 2005, both the RSA algorithm and elliptic curve cryptography have served as the primary signature algorithms for DNSSEC. But with the potential of large-scale quantum computing on the horizon, there may soon come a time when those algorithms no longer suffice.

(more…)
Close-up of a circuit board with glowing orange and blue pathways.

The 2024-2026 Root Zone KSK Rollover: Initial Observations and Early Trends

• By • Security

On Jan. 11, 2025, Verisign supported the Internet Corporation for Assigned Names and Numbers (ICANN) in taking a major step to ensure the continued security, stability, and resiliency of the Domain Name System (DNS). While imperceptible to most users, this action – specifically, the introduction of a new Domain Name System Security Extensions (DNSSEC) Key Signing Key (KSK) in the root zone – is the next step of a multi-year-long process to change, or “roll,” the cryptographic key that secures the root of the DNS. In this blog post, we’ll go into more detail about what this means and what observations we can make about the new key, which we refer to as “KSK-2024.”1

(more…)

Verisign and ICANN Renew Root Zone Maintainer Service Agreement

• By • Security

On October 20th, ICANN and Verisign renewed the agreement under which Verisign will continue to act as Root Zone Maintainer for the Domain Name System (DNS) for another 8-year term. The Root Zone sits atop the hierarchical architecture of the DNS and is essential to virtually all internet navigation, acting as the dynamic, cryptographically secure, global directory of all top-level domains that exist in the DNS. The Root Zone Maintainer is a unique role that ensures the cryptographic signing and publication of the Root Zone no less than once a day, without which, navigation on the internet would be impossible.

(more…)
Blue abstract lines and dots on a dark blue gradient background.

The Verisign Shared Registration System: A 25-Year Retrospective

• By • Security

Every day, there are tens of thousands of domain names registered across the globe – often as a key first step in creating a unique online presence. Making that experience possible for Verisign-operated top-level domains (TLDs) like .com and .net is a powerful and flexible technology platform first introduced 25 years ago.

Thanks to the Shared Registration System (SRS) – a hardware and software system conceptualized, designed, and launched by our teams 25 years ago – we’re able to successfully manage relationships with approximately 2,000 ICANN-accredited registrars who generally submit more than 100 million domain name transactions daily. Over the past quarter century, the SRS has thrived and grown with the global internet, in large part because we’ve continuously scaled and evolved the technology to meet exponentially increasing global demand, and a rapidly changing cyberthreat landscape.

(more…)
A digital blue tree on a gradient blue background.

Verisign Provides Open Source Implementation of Merkle Tree Ladder Mode

• By • Security

The quantum computing era is coming, and it will change everything about how the world connects online. While quantum computing will yield tremendous benefits, it will also create new risks, so it’s essential that we prepare our critical internet infrastructure for what’s to come. That’s why we’re so pleased to share our latest efforts in this area, including technology that we’re making available as an open source implementation to help internet operators worldwide prepare.

(more…)