Emergency Key Rollover in DNSSEC

DNS Security Extensions (DNSSEC) is introduced as a set of extensions to DNS which provide data origin authentication, data integrity, and authenticated denial of existence. To maintain the integrity of the DNSSEC system in the case of key compromise, the compromised keys active in the trust chain need to be renewed as soon as possible. This paper is the first to provide extensive and systematic analysis of emergency key rollover in DNSSEC. It identifies the space of key management choices in emergency key rollover. It also presents timelines for the key rollover and discusses considerations surrounding the timing of events in the rolling of a key. The performances of the proposed rollover algorithms are analyzed in four aspects. Finally, the transition delays are evaluated on all signed TLDs.