SubPro WT 4: IDN / Technical / Operations

Meeting #10 0300 UTC 04 May 2017

Agenda

Welcome and Opening Remarks

SOI updates

​

Full WG Update

Name Collisions: a definition, pre-2012 information

Name Collisions in 2012-round gTLDs

AOB

​

AI’s

Questions?

1-2

3

4

5

Possible Name collisions policy options

6

AOB

7

| 2

1. Welcome and Opening Remarks
2. SOI updates

3. Full WG Update

4. Name Collisions: a definition, pre-2012 information

​

​

Name collisions: possible work definition

• “A name collision occurs when an attempt to resolve a name used in a private name space (e.g. under a non-delegated Top-Level Domain, or a short, unqualified name) results in a query to the public Domain Name System (DNS). When the administrative boundaries of private and public namespaces overlap, name resolution may yield unintended or harmful results.” (ICANN Name Collisions website)
• It can be caused by software behavior trying to match a request to a name, by deliberate configuration of a previously not delegated TLD, by roaming devices or by application bug (network x file-name confusions)

| 6

Name collisions: new name, old phenomena

• Once called “Invalid TLDs” or “Invalid Top Level Domain Queries”
• First described in a Jun 2009 CircleID post by George Kirikos:
• http://www.circleid.com/posts/20090618_most_popular_invalid_tlds_should_be_reserved/
• Following that post call to action, SSAC issued SAC 045 “Invalid Top Level Domain Queries at the Root Level of the Domain Name System” in November 2010
• Some possibly risky TLDs ended-up excluded like .local and .localhost; some allowed but not applied for, like .lan ; two received applications: .home and .corp.

| 7

5. Name Collisions in 2012-round gTLDs

Name collisions after the application window (1/2)

• In March 2013, SSAC published SAC057, an advisory on internal names certificates detailing a significant information security threat vector to one of the possible collision sources: locally administered zones
• This triggered an ICANN-commissioned study by Interisle, which expanded the alleged possible harms to malfunctions, not only deliberate compromise of internal certificates
• This study started a fierce battle between some overplaying the consequences, and some downplaying the effects of name collisions

| 9

Name collisions after the application window (2/2)

• ICANN Org made a fork in the road, allowing TLDs to be delegated if registries blocked a list of observed possible collisions (APD - Alternate Path to Delegation)
• A new study was commissioned with JAS Advisors, which would create the Name collisions Framework
• CA/Browser Forum, the organisation that congregates most CAs and browser software developers, phased out issuance and revocation of internal name certificates

| 10

Name collisions framework in 2012-round

• All 2012-round TLDs were required to pass a controlled interruption period and be able to respond within two hours for life-threatening collision reports, for the first two years of delegation
• During the controlled interruption period of 90 days, names would respond with an internal invalid address to warn affected users without exposing them
• For APD lists, the same applied for those names in the list
• Current number of collision reports is 37 occurrences reported to ICANN, of which 0 were life-threatening
• Other collisions might have been reported directly to registries, and some not reported at all

| 11

6. Possible Name Collision Policy Options

CC2 questions and possible policy options

• 4.4.2:
• List of names to be excluded ? Method to produce such list ?
• Name collision evaluation of each string ?
• 4.4.3:
• Reduction of controlled interruption period ?
• CDAR report somewhat implies that a 60-day period could be enough
• 4.4.1 and 4.4.3:
• Initiating the interruption period before end of evaluation and delegation ?

| 13

7. AOB

​

​