DNS Belgium has adjusted the security algorithm for the .be, .vlaanderen, and .brussels domain zones. The organization is exchanging the RSA/SHA-256 algorithm for a more modern and secure variant.
Last month, DNS Belgium upgraded the algorithm for signing records to a new variant. Algorithm 8 (RSA/SHA-256) had been in use for fifteen years. Now, DNS Belgium is embracing Algorithm 13 (ECDSA Curve P-256). With this, the top-level domain manager of Belgium expects to be up-to-date for at least another five years.
The algorithm in question is responsible for the digital signing of domain names. It ensures that when you visit a website with a .be, .vlaanderen, or .brussels extension, you are sure to arrive at the correct place. Without secure signing, it is technically possible to intercept or manipulate traffic. The algorithm is part of DNSSEC: the security layer of DNS data.
Smaller and safer
The upgrade took place in phases, with .vlaanderen and .brussels switching first, followed by the larger .be zone.
With the switch, digital signatures become smaller, requiring less data traffic. The downside of this reduction is that validation requires slightly more computing capacity. According to DNS Belgium, this is not a problem for modern network infrastructure. Users will not notice the switch.
“The keys are smaller but provide the same or better protection against brute force attacks,” explains Stijn Niclaes, DNS infrastructure manager at DNS Belgium. “Compare it to a smaller combination lock with more combinations.”
Careful preparation
An algorithm upgrade within DNSSEC requires careful preparation. Initially, the infrastructure was adapted for dual signing. This means that domains were temporarily signed with both algorithms. This ensures that all systems continue to work correctly during the transition period. Only when the new algorithm is recognized worldwide by caches and name servers can the old one be safely phased out. The process took several weeks.
According to DNS Belgium, it is important to plan such a switch in a timely manner, well before support for an old algorithm disappears. The new algorithm must also be sufficiently supported in the global infrastructure. In Europe, some extensions, such as .nl, have previously switched to algorithm 13, but many others have not.