Quantum computing is threatening current cryptography, especially the asymmetric algorithms used in many Internet protocols. More secure algorithms, colloquially referred to as Post-Quantum Cryptography (PQC), are under active development. These new algorithms differ significantly from current ones. They can have larger signatures or keys, and often require more computational power. This means we cannot just replace existing algorithms by PQC alternatives, but need to evaluate if they meet the requirements of the Internet protocols that rely on them. In this paper we provide a case study, analyzing the impact of PQC on the Domain Name System (DNS) and its Security Extensions (DNSSEC). In its main role, DNS translates human-readable domain names to IP addresses and DNSSEC guarantees message integrity and authenticity. DNSSEC is particularly challenging to transition to PQC, since DNSSEC and its underlying transport protocols require small signatures and keys and efficient validation. We evaluate current candidate PQC signature algorithms in the third round of the NIST competition on their suitability for use in DNSSEC. We show that three algorithms, partially, meet DNSSEC's requirements but also show where and how we would still need to adapt DNSSEC. Thus, our research lays the foundation for making DNSSEC, and protocols with similar constraints ready for PQC.
Quantum computing is threatening current cryptography, especially the asymmetric algorithms used in many Internet protocols. More secure algorithms, colloquially referred to as Post-Quantum Cryptography (PQC), are under active development. These new algorithms differ significantly from current ones. They can have larger signatures or keys, and often require more computational power. This means we cannot just replace existing algorithms by PQC alternatives, but need to evaluate if they meet the requirements of the Internet protocols that rely on them. In this paper we provide a case study, analyzing the impact of PQC on the Domain Name System (DNS) and its Security Extensions (DNSSEC). In its main role, DNS translates human-readable domain names to IP addresses and DNSSEC guarantees message integrity and authenticity. DNSSEC is particularly challenging to transition to PQC, since DNSSEC and its underlying transport protocols require small signatures and keys and efficient validation. We evaluate current candidate PQC signature algorithms in the third round of the NIST competition on their suitability for use in DNSSEC. We show that three algorithms, partially, meet DNSSEC's requirements but also show where and how we would still need to adapt DNSSEC. Thus, our research lays the foundation for making DNSSEC, and protocols with similar constraints ready for PQC.
Abstract The development of quantum computing poses a threat to many internet protocols because it undermines the security of current asymmetric cryptography. New types of algorithms, collectively known as post-quantum cryptography (PQC), are being developed and tested as potential replacements. Despite being engineered to counter quantum computers using Shor’s algorithm, these systems frequently demand larger keys or signatures and substantial computational resources. This complicates the implementation of these algorithms in higher-level protocols, which requires thorough studies of the transition consequences. This paper evaluates the usefulness of one such PQC algorithm, FALCON-512, in the DNSSEC protocol. Using a containerized testbed, simulated DNS traffic is analyzed with a focus on key performance metrics, namely network latency and error rates, as the number of DNS clients in the network increases. The results show that PQC-enabled DNSSEC introduces higher error rates compared to today’s algorithms, especially in NSEC responses used to deny the existence of DNS records, which represent a significant increase, resulting in the network’s overload. The main contribution of this article is the validation of previous theoretical assumptions on the practical implications of FALCON-512 signature sizes in the implementation to DNSSEC. The differences in latency observed between nameservers in the DNS hierarchy during this study may inform DNS operators during the transition to PQC.
The emergence of quantum computers poses a significant threat to current secure service, application and/or protocol implementations that rely on RSA and ECDSA algorithms, for instance DNSSEC, because public-key cryptography based on number factorization or discrete logarithm is vulnerable to quantum attacks. This paper presents the integration of post-quantum cryptographic (PQC) algorithms into CoreDNS to enable quantum-resistant DNSSEC functionality for the first time. We have developed a plugin that extends CoreDNS with support for five PQC signature algorithm families: ML-DSA, FALCON, SPHINCS+, MAYO, and SNOVA. Our implementation maintains compatibility with existing DNS resolution flows while providing on-the-fly signing using quantum-resistant signatures. A benchmark has been performed and performance evaluation results reveal significant trade-offs between security and efficiency. The results indicate that while PQC algorithms introduce operational overhead, several candidates offer viable compromises for transitioning DNSSEC to quantum-resistant cryptography.
The Domain Name System (DNS), an important component of the Internet infrastructure, is vulnerable to various attacks that can jeopardize the security and privacy of Internet communications. While DNS over TLS (DoT) is widely used to improve DNS security, the advent of quantum computing poses a significant threat to the underlying cryptographic algorithms used in TLS. In this paper, we propose a comprehensive framework for DNS over Post-Quantum TLS (DoPQT) to address this challenge. Our framework integrates post-quantum cryptographic algorithms into DoT, ensuring robust security against both classical and quantum attacks. We introduce a hybrid key exchange mechanism and post-quantum authentication procedures to protect the confidentiality, integrity, and authenticity of DNS traffic. DoPQT has the potential to offer comparable performance to existing solutions while demonstrating superior quantum resistance. This research contributes to the development of a secure and resilient DNS infrastructure in the post-quantum era. It has been observed that the handshake process is most affected by increased DNS queries and is the main source of the bottleneck. On the other hand, the percentage loss in throughput when using the PQC algorithm (i.e., MLKEM) is about 33-40% for different DNS queries.
Like all other digital systems, the Domain Name System (DNS) needs to remain secure, even when future quantum computers are built. This means that DNS operators need to understand the implications of replacing the currently deployed cryptographic algorithms of the DNS Security Extensions (DNSSEC) with post-quantum cryptography (PQC) ones, which are vastly different. We therefore empirically analyze the signing performance of promising PQC algorithms MAYO-2 and Falcon-512 from a DNS operator point of view, in terms of zone file size, signing time, and validation time, and compare them to currently deployed algorithms RSA-1280 and ECDSA-P256. In our experiments, we use a PQC-enhanced DNSSEC signer, the zone files of three country code Top-Level Domains (ccTLDs) of different sizes, and two different CPU models to measure the effects of CPU optimizations. We find that the DNSSEC signing performance of MAYO-2 is better than RSA-1280, while Falcon-512 performs similarly. The validation performance of MAYO-2 is better than ECDSA-P256 and comparable to RSA-1280, whereas Falcon-512 is 0.3 times slower than ECDSA-P256. These results suggest that DNSSEC signing with MAYO-2 and Falcon-512 is feasible for TLD operators. However, Falcon-512 generates larger signature size and MAYO-2 has larger public keys. These drawbacks should be studied further to assess their operational impact on the validation side, for example by studying the behavior of DNS resolvers with PQC algorithms.
The threats are existential to the traditional cryptosystems of public keys, including RSA, Diffie-Hellman, and elliptic curve cryptography (ECC), due to the rapid progress in quantum computing. Such algorithms as the Shor and Grover algorithms prove that as soon as large scale quantum computers are achieved, these classical cryptographic protocols will not provide any privacy and integrity to online communication. This has created an emergency to find post-quantum cryptography (PQC), or quantum-safe cryptography, which will resist attacks by both classical and quantum attackers. The paper is a review of the latest research and development in post-quantum cryptographic algorithms and their implementation in current security systems. We organize quantum-safe methods into significant organizations such as lattice-based, hash-based, multivariate polynomial-based and code-based encrypted communications. Each type has been evaluated critically based on computational efficiency, key sizes, speed of encryption/decryption and security proofs. The survey also examines the current standardization activities happening in the world and especially the U.S. National Institute of Standards and Technology (NIST) PQC competition, which lists candidate algorithms that have advanced to standard adoption. Besides this, the paper addresses hybrid cryptographic designs that use both classical and post-quantum bases in ensuring a seamless migration in the transition phase. Internet security protocols like TLS, VPNs and blockchain consensus as applications of PQC are examined in detail. Lastly, we pinpoint open research issues, which include creating lightweight PQC to support resource-constrained IoT devices, balancing performance and strong security assurances, and interoperability between the new PQC algorithms and existing infrastructures. Through detailed survey we inform the future of researchers, practitioners, and policymakers on the preparation of the post-quantum era of secure digital communications.
Post-Quantum Cryptography (PQC) is a rapidly developing field that addresses the potential threat quantum computers pose to the security of current cryptographic algorithms. With the rapid advancement of quantum computing technologies, it has become imperative to identify and standardize new cryptographic techniques that can withstand attacks from quantum computers. This paper explores the motivation behind PQC and provides an overview of the experimental research conducted in the field. It highlights the vulnerabilities of traditional cryptographic algorithms, such as RSA and ECC, to quantum attacks and emphasizes the need for transitioning to quantum-resistant alternatives. The experiments conducted in the PQC domain encompass the evaluation and analysis of candidate algorithms submitted to the NIST PQC competition. These experiments involve comprehensive security assessments, performance evaluations, and code audits to ensure the suitability and effectiveness of the proposed algorithms in real-world scenarios. This paper provides guidelines for organizations and practitioners adopting PQC. It discusses considerations for selecting and implementing post-quantum cryptographic algorithms, including security levels, algorithmic characteristics, performance tradeoffs, and integration challenges. It also outlines the importance of a smooth transition from classical to post-quantum cryptographic systems and highlights the need for standardization efforts to ensure interoperability and compatibility.