The emergence of quantum computers poses a significant threat to current secure service, application and/or protocol implementations that rely on RSA and ECDSA algorithms, for instance DNSSEC, because public-key cryptography based on number factorization or discrete logarithm is vulnerable to quantum attacks. This paper presents the integration of post-quantum cryptographic (PQC) algorithms into CoreDNS to enable quantum-resistant DNSSEC functionality for the first time. We have developed a plugin that extends CoreDNS with support for five PQC signature algorithm families: ML-DSA, FALCON, SPHINCS+, MAYO, and SNOVA. Our implementation maintains compatibility with existing DNS resolution flows while providing on-the-fly signing using quantum-resistant signatures. A benchmark has been performed and performance evaluation results reveal significant trade-offs between security and efficiency. The results indicate that while PQC algorithms introduce operational overhead, several candidates offer viable compromises for transitioning DNSSEC to quantum-resistant cryptography.
The emergence of quantum computers poses a significant threat to current secure service, application and/or protocol implementations that rely on RSA and ECDSA algorithms, for instance DNSSEC, because public-key cryptography based on number factorization or discrete logarithm is vulnerable to quantum attacks. This paper presents the integration of post-quantum cryptographic (PQC) algorithms into CoreDNS to enable quantum-resistant DNSSEC functionality for the first time. We have developed a plugin that extends CoreDNS with support for five PQC signature algorithm families: ML-DSA, FALCON, SPHINCS+, MAYO, and SNOVA. Our implementation maintains compatibility with existing DNS resolution flows while providing on-the-fly signing using quantum-resistant signatures. A benchmark has been performed and performance evaluation results reveal significant trade-offs between security and efficiency. The results indicate that while PQC algorithms introduce operational overhead, several candidates offer viable compromises for transitioning DNSSEC to quantum-resistant cryptography.
Like all other digital systems, the Domain Name System (DNS) needs to remain secure, even when future quantum computers are built. This means that DNS operators need to understand the implications of replacing the currently deployed cryptographic algorithms of the DNS Security Extensions (DNSSEC) with post-quantum cryptography (PQC) ones, which are vastly different. We therefore empirically analyze the signing performance of promising PQC algorithms MAYO-2 and Falcon-512 from a DNS operator point of view, in terms of zone file size, signing time, and validation time, and compare them to currently deployed algorithms RSA-1280 and ECDSA-P256. In our experiments, we use a PQC-enhanced DNSSEC signer, the zone files of three country code Top-Level Domains (ccTLDs) of different sizes, and two different CPU models to measure the effects of CPU optimizations. We find that the DNSSEC signing performance of MAYO-2 is better than RSA-1280, while Falcon-512 performs similarly. The validation performance of MAYO-2 is better than ECDSA-P256 and comparable to RSA-1280, whereas Falcon-512 is 0.3 times slower than ECDSA-P256. These results suggest that DNSSEC signing with MAYO-2 and Falcon-512 is feasible for TLD operators. However, Falcon-512 generates larger signature size and MAYO-2 has larger public keys. These drawbacks should be studied further to assess their operational impact on the validation side, for example by studying the behavior of DNS resolvers with PQC algorithms.
Abstract The development of quantum computing poses a threat to many internet protocols because it undermines the security of current asymmetric cryptography. New types of algorithms, collectively known as post-quantum cryptography (PQC), are being developed and tested as potential replacements. Despite being engineered to counter quantum computers using Shor’s algorithm, these systems frequently demand larger keys or signatures and substantial computational resources. This complicates the implementation of these algorithms in higher-level protocols, which requires thorough studies of the transition consequences. This paper evaluates the usefulness of one such PQC algorithm, FALCON-512, in the DNSSEC protocol. Using a containerized testbed, simulated DNS traffic is analyzed with a focus on key performance metrics, namely network latency and error rates, as the number of DNS clients in the network increases. The results show that PQC-enabled DNSSEC introduces higher error rates compared to today’s algorithms, especially in NSEC responses used to deny the existence of DNS records, which represent a significant increase, resulting in the network’s overload. The main contribution of this article is the validation of previous theoretical assumptions on the practical implications of FALCON-512 signature sizes in the implementation to DNSSEC. The differences in latency observed between nameservers in the DNS hierarchy during this study may inform DNS operators during the transition to PQC.
Quantum computing is threatening current cryptography, especially the asymmetric algorithms used in many Internet protocols. More secure algorithms, colloquially referred to as Post-Quantum Cryptography (PQC), are under active development. These new algorithms differ significantly from current ones. They can have larger signatures or keys, and often require more computational power. This means we cannot just replace existing algorithms by PQC alternatives, but need to evaluate if they meet the requirements of the Internet protocols that rely on them. In this paper we provide a case study, analyzing the impact of PQC on the Domain Name System (DNS) and its Security Extensions (DNSSEC). In its main role, DNS translates human-readable domain names to IP addresses and DNSSEC guarantees message integrity and authenticity. DNSSEC is particularly challenging to transition to PQC, since DNSSEC and its underlying transport protocols require small signatures and keys and efficient validation. We evaluate current candidate PQC signature algorithms in the third round of the NIST competition on their suitability for use in DNSSEC. We show that three algorithms, partially, meet DNSSEC's requirements but also show where and how we would still need to adapt DNSSEC. Thus, our research lays the foundation for making DNSSEC, and protocols with similar constraints ready for PQC.
The advent of quantum computing poses a significant threat to current cryptographic systems, particularly public-key algorithms such as RSA and ECC, which are vulnerable to quantum attacks like Shor's algorithm. Post-Quantum Cryptography (PQC) aims to develop and standardize quantum-resistant cryptographic algorithms to secure digital communications in the quantum era. This paper examines the current landscape of PQC, focusing on the evaluation and standardization efforts led by organizations such as the National Institute of Standards and Technology (NIST). We analyze the major families of quantum-resistant algorithms, including lattice-based, hash-based, code-based, multivariate, and isogeny-based cryptography, discussing their security guarantees, performance trade-offs, and implementation challenges. Furthermore, we review NIST's PQC standardization process, highlighting selected finalists and alternate candidates, and explore the ongoing transition challenges in adopting these algorithms across industries. Finally, we discuss future directions for PQC research, including hybrid cryptographic systems and the need for continued cryptanalysis to ensure long-term security. This work provides a comprehensive overview of the progress and challenges in deploying quantum-resistant cryptography to safeguard against emerging quantum threats.
The Domain Name System (DNS) plays a foundational role in Internet infrastructure, yet its core protocols remain vulnerable to compromise by quantum adversaries. As cryptographically relevant quantum computers become a realistic threat, ensuring DNS confidentiality, authenticity, and integrity in the post-quantum era is imperative. In this paper, we present a comprehensive system-level study of post-quantum DNS security across three widely deployed mechanisms: DNSSEC, DNS-over-TLS (DoT), and DNS-over-HTTPS (DoH). We propose Post-Quantum Cryptographic (PQC)-DNS, a unified framework for benchmarking DNS security under legacy, post-quantum, and hybrid cryptographic configurations. Our implementation leverages the Open Quantum Safe (OQS) libraries and integrates lattice- and hash-based primitives into BIND9 and TLS 1.3 stacks. We formalize performance and threat models and analyze the impact of post-quantum key encapsulation and digital signatures on end-to-end DNS resolution. Experimental results on a containerized testbed reveal that lattice-based primitives such as Module-Lattice-Based Key-Encapsulation Mechanism (MLKEM) and Falcon offer practical latency and resource profiles, while hash-based schemes like SPHINCS+ significantly increase message sizes and processing overhead. We also examine security implications including downgrade risks, fragmentation vulnerabilities, and susceptibility to denial-of-service amplification. Our findings inform practical guidance for deploying quantum-resilient DNS and contribute to the broader effort of securing core Internet protocols for the post-quantum future.
This thesis investigates the current state of Post-quantum cryptography (PQC) in the industry, with a particular focus on its practical deployment, integration challenges, and performance implications.The study combines a structured analysis of academic literature, standardization efforts, and industry guidance with an experimental evaluation of PQC integration in widely used security protocols. The analysis shows that, while significant progress has been made in the standardization of quantum-resistant algorithms such as ML-KEM, ML-DSA, and SLH-DSA, real-world adoption remains in an early and transitional phase. Organizations primarily focus on evaluation and pilot implementations, as deployment is constrained by interoperability issues, implementation maturity, and the complexity of migrating existing cryptographic infrastructures.To complement the conceptual analysis, experimental measurements were conducted for TLS, SSH, and IPsec to evaluate the performance impact of hybrid post-quantum cryptographic mechanisms. The results indicate that performance overhead is not uniform across components. In particular, post-quantum signature schemes introduce significant computational and network overhead, mainly due to increased key and certificate sizes. In contrast, hybrid key exchange mechanisms show only moderate performance impact across all evaluated protocols.The findings highlight that the primary challenge of PQC adoption lies not in algorithm design but in practical integration and large-scale migration. Hybrid cryptographic approaches emerge as the most viable strategy for enabling a gradual transition, balancing improved security against quantum threats with operational feasibility.Overall, this thesis demonstrates that PQC is transitioning from a theoretical research field to a practical engineering challenge, with significant implications for the future design of secure communication systems.