Network operators, researchers, and Internet infrastructure experts from across the Asia Pacific region gathered in Mumbai, India, for APNIC 62. Held from September 4 to 10, 2026, the biannual conference served as a vital forum for discussing operational experiences, emerging technologies, and the ongoing structural challenges facing global Internet operations.
Technical Session 1 focused heavily on the foundational layers of the public network, examining critical developments in DHCP and DNS management, the upcoming DNSSEC root Key-Signing Key rollover, the growing limitations of traditional X.509 certificate revocation mechanisms, and the urgent necessity for advanced Border Gateway Protocol (BGP) security protocols.
ISC Stork: A Unified Management Tool for Kea DHCP and BIND DNS
The session opened with a presentation from Marcin Siodelski, Senior Software Engineer at the Internet Systems Consortium (ISC), who addressed the evolving landscape of core network services. ISC software has underpinned Internet service delivery for decades, and while the organization is widely recognized today for operating the global F-root DNS service, software development remains a foundational pillar of its mission. BIND 9 continues to power authoritative and recursive DNS services across the globe, while Kea DHCP has emerged as the modern successor to the legacy ISC DHCP server, which has officially reached its end of life.
Because complex DHCP and DNS environments require sophisticated oversight, the ISC developed Stork, an advanced graphical management platform designed to integrate seamlessly with BIND 9 and PowerDNS. Siodelski explained that Stork bridges the gap between operational teams and core infrastructure by providing a centralized web-based management interface equipped with comprehensive monitoring, reporting, and dashboard capabilities built upon integrations with Prometheus and Grafana.
DHCP remains a fundamental building block of network service delivery, responsible for managing IP address pools, allocating subnets, and maintaining static address and prefix assignments for individual hosts using MAC addresses or client identifiers. Through Kea, network operators can manage high-availability configurations, failover systems, lease tracking, and log inspection from a single pane of glass. Siodelski demonstrated these Grafana integrations alongside subnet management tools during his presentation.
The platform’s integration with BIND 9 extends this unified visibility to complex DNS environments, allowing operators to monitor configuration views, browse zones, and track zone transfers, including the detection of serial number mismatches between servers. Although PowerDNS integration remains experimental, it aims to deliver a unified management experience across mixed deployments. Looking ahead, the ISC roadmap features several planned enhancements throughout 2026 and 2027, such as stale DNS record detection and removal in dynamic environments, zone cloning and validation, BIND 9 configuration editing, catalog zone support, and enhanced log monitoring.
Preparing for the DNSSEC Root Zone KSK Rollover
The discussion shifted from core server management to cryptographic trust anchors with Champika Wijayatunga, Technical Engagement Director for the Asia Pacific region at ICANN. Wijayatunga outlined the operational preparations for the upcoming rollover of the DNSSEC root Key-Signing Key (KSK), scheduled for October 11, 2026.
To provide essential context, Wijayatunga detailed the mechanics of the DNSSEC chain of trust, which anchors the security of the global root zone. At the absolute peak of this hierarchy, the Trust Anchor cannot be validated against a higher-level key; instead, systems must be pre-configured with it as an immutable, trusted starting point. The KSK undergoing the rollover is the public component of a cryptographic key pair, with the corresponding private key securely maintained offline inside hardware security modules (HSMs) housed in heavily guarded ICANN facilities on the east and west coasts of the United States.
While private keys generate cryptographic signatures over DNS data, the published public keys enable validating resolvers to independently verify the authenticity, integrity, and completeness of zone information. Periodic key rollovers represent standard operational best practice, mitigating long-term security risks and enabling the adoption of stronger cryptographic algorithms and key lengths to counter emerging threats, such as quantum computing, which could potentially accelerate the degradation of traditional RSA key pairs.
ICANN coordinates these sensitive key management operations through public key ceremonies conducted at its facilities with the active participation of Trusted Community Representatives. While these ceremonies are livestreamed for transparency and typically scheduled every three to four years, the current rollover experienced prior delays. Wijayatunga reminded network operators running DNSSEC validation to verify that their resolver systems maintain current Trust Anchors. While many modern systems handle updates automatically via RFC 5011, certain legacy or specialized deployments may necessitate manual intervention to prevent catastrophic validation failures.
The Breakdown of X.509 Certificate Revocation in Modern TLS
Addressing the security mechanisms protecting modern web traffic, Geoff Huston, Chief Scientist at APNIC, delivered an analytical presentation on the persistent structural failures of X.509 certificate management, which underlies the authentication and privacy guarantees of HTTPS and TLS.
Huston explained that a digital certificate represents a third-party attestation of identity issued by a private Certificate Authority (CA) based on documentation supplied by an applicant. However, these CAs do not necessarily hold the underlying authority to issue legal names, domains, or other forms of organizational identity. Using the example of a commercial banking portal, Huston posed a fundamental question: Does the revocation of a compromised certificate actually prevent users from accessing a fraudulent or compromised site?
Examining domain resolution patterns, Huston noted that high-profile sites often rely on third-party cloud infrastructure rather than direct corporate hosting, utilizing certificates issued months prior. During extended validity windows, numerous security failures can transpire, ranging from CA compromises and key thefts to simple operational configuration errors. Consequently, the industry requires reliable mechanisms to invalidate certificates when emergencies occur.
The traditional remedy—the X.509 Certificate Revocation List (CRL)—publishes the serial numbers of untrusted certificates. In theory, web browsers fetch the CRL, verify its signature, and check target certificates against the registry. In practice, however, CRLs have grown excessively large, often containing tens of thousands of entries, making them far too slow and resource-intensive for routine browser validation during real-time connection establishment.
Alternative approaches, such as the Online Certificate Status Protocol (OCSP) defined in RFC 2560, introduced real-time status queries but immediately generated severe privacy concerns by exposing user browsing habits while introducing centralization and denial-of-service risks. Although OCSP stapling allows servers to supply pre-signed validation responses during the TLS handshake, a compromised server is unlikely to provide evidence of its own revocation. Browser vendors have responded with divergent strategies; major engines have largely abandoned reliance on traditional real-time checks, and even high-volume certificate authorities like Let’s Encrypt have discontinued dedicated OCSP services.
Huston demonstrated that testing revocation cycles against major modern web browsers yields inconsistent enforcement, with certain browsers failing to recognize revoked credentials. While the industry has attempted to mitigate this by progressively shortening certificate validity lifetimes—moving from 90 days down to 45 days, and in some cases mere days—Huston argued that security incidents occur in milliseconds, rendering human-scale timeframes inadequate. As a long-term alternative, Huston proposed migrating toward DNS-based authentication models, such as DANE combined with DNSSEC, which support significantly shorter lifetimes and native cache expiry mechanisms to defend the web against rapid threats.
Addressing the Good Neighbor Problem in BGP Security
Concluding the technical session, Ritesh Mukherjee, Product Management Leader for NOS and AI at Nokia, addressed the escalating challenges of Border Gateway Protocol security across the Asia Pacific region. Mukherjee noted that while Route Origin Validation (ROV) helps verify whether an Autonomous System is authorized to originate specific routes, and Autonomous System Provider Authorization (ASPA) validates the integrity of AS paths, structural vulnerabilities continue to cause widespread routing anomalies.
Mukherjee cited multiple real-world incidents illustrating the fragility of global routing. In one notable event, an operator inadvertently blackholed major messaging traffic, triggering a false route origination that was rapidly detected by the RIPE RIS system. Affected services responded by announcing more-specific prefixes, which were subsequently propagated across international boundaries, leading foreign networks to select what appeared to be shorter, compromised paths. Because routing registry data confirmed the originating network lacked authorization, ROV would have successfully intercepted and dropped the rogue announcements; however, global ROV enforcement remains critically low, with adoption lagging significantly in regions like India despite high rates of Route Origin Authorization publication.
Additional incidents involving complex multi-hop filtering failures and massive unexpected prefix announcements demonstrated how limited path filtering, low ROV enforcement, and the absence of maximum-prefix limits on external BGP sessions can transform localized configuration mistakes into transcontinental routing disruptions. Mukherjee emphasized that addressing these systemic vulnerabilities requires moving beyond individual administrative domains to solve the broader "good neighbor problem."
To assist network operators in auditing and securing their routing infrastructure, Mukherjee highlighted RAVEN, an open-source BGP Routing Security Monitor developed by Nokia and available on GitHub. RAVEN operates as a lightweight binary utilizing BGP Monitoring Protocol (BMP) data feeds, integrating seamlessly with RPKI validators and Grafana dashboards to give operators real-time visibility into routing exposure before enforcing active drop policies.
Mukherjee strongly urged network operators to implement rigorous eBGP maximum-prefix limits, accelerate the long-term deployment of ASPA alongside ROV drop policies, and actively participate in collaborative global initiatives such as MANRS to harden the resilience of the global Internet routing architecture.
Leave a Reply