Quantum Information & Computation
Volume 25, Issue 5
RESEARCH ARTICLE Open access

Analysis and Evaluation of Post-Quantum Cryptography for DNSSEC

Tomasz Nal, Marcin Niemiec

Author affiliations
  • Tomasz Nal1
  • Marcin Niemiec1
  1. AGH University of Krakow, Faculty of Computer Science, Electronics and Telecommunications, Mickiewicza 30, Krakow, Poland

pp. 438-452 · 10.2478/qic-2025-0025

Read PDF View on Reference Global
On this page

Abstract

The development of quantum computing poses a threat to many internet protocols because it undermines the security of current asymmetric cryptography. New types of algorithms, collectively known as post-quantum cryptography (PQC), are being developed and tested as potential replacements. Despite being engineered to counter quantum computers using Shor’s algorithm, these systems frequently demand larger keys or signatures and substantial computational resources. This complicates the implementation of these algorithms in higher-level protocols, which requires thorough studies of the transition consequences. This paper evaluates the usefulness of one such PQC algorithm, FALCON-512, in the DNSSEC protocol. Using a containerized testbed, simulated DNS traffic is analyzed with a focus on key performance metrics, namely network latency and error rates, as the number of DNS clients in the network increases. The results show that PQC-enabled DNSSEC introduces higher error rates compared to today’s algorithms, especially in NSEC responses used to deny the existence of DNS records, which represent a significant increase, resulting in the network’s overload. The main contribution of this article is the validation of previous theoretical assumptions on the practical implications of FALCON-512 signature sizes in the implementation to DNSSEC. The differences in latency observed between nameservers in the DNS hierarchy during this study may inform DNS operators during the transition to PQC.
Open accessCC BY-NC-ND 4.0

Keywords

  • post-quantum cryptography
  • FALCON
  • DNSSEC
  • benchmarking
  • latency
  • error rate

Suggested citation

Tomasz Nal, Marcin Niemiec (2025). Analysis and Evaluation of Post-Quantum Cryptography for DNSSEC. Quantum Information & Computation, 25(5), 438-452. https://doi.org/10.2478/qic-2025-0025

Download BibTeX

References (27)

  1. P. W. Shor (1999). “Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer.” SIAM Review, 41: 2, 303–332.DOI: 10.1137/S0036144598347011Google Scholar
  2. National Institute of Standards and Technology (2024). NIST Releases First 3 Finalized Post-Quantum Encryption Standards, [news release]. Available at: https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards (Accessed on 08 June 2025).Google Scholar
  3. D. Dziechciarz, M.Niemiec (2025). “E?iciency analysis of NIST-standardized post-quantum cryptographic algorithms for digital signatures in various environments.” Electronics, 14: 1, 70, doi: 10.3390/electron-ics14010070DOI: 10.3390/electronics14010070Google Scholar
  4. NIST Post-Quantum Cryptography Team (2016). Post-Quantum Cryptography: NIST’s Plan for the Future [Presentation]. Available at: https://csrc.nist.gov/csrc/media/projects/post-quantum-cryptography/documents/pqcrypto-2016-presentation.pdfGoogle Scholar
  5. S. Rose, M. Larson, D Massey, R. Austein and R. Arends (2005). “DNS security introduction and requirements,” RFC 4033, doi: 10.17487/RFC4033.DOI: 10.17487/rfc4033Google Scholar
  6. G. Alagic, D. Apon, D. Cooper, Q. Dang, T. Dang, J. Kelsey, J. Lichtinger, Y.-K. Liu, C. Miller, D. Moody, R. Peralta, R. Perlner, A. Robinson, and D. Smith-Tone (2022). Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process, National Institute of Standards and Technology Interagency or Internal Report NIST IR 8413-upd1, https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8413-upd1.pdfDOI: 10.6028/NIST.IR.8413-upd1Google Scholar
  7. NIST - Information Technology Laboratory - Computer Security Resource Center. Post-Quantum Cryptography [web resource], https://csrc.nist.gov/pqc-standardizationGoogle Scholar
  8. P.-A. Fouque, J. Hoffstein, P. Kirchner, V. Lyubashevsky, T. Pornin, T. Prest, T. Ricosset, G. Seiler, W. Whyte, and Z. Zhang, FALCON [web resource] (Accessed: 2025, June 08), https://falcon-sign.info/Google Scholar
  9. M. Müller, J. de Jong, M. van Heesch, B. Overeinder, and R. van Rijswijk-Deij (2020). “Retrofitting post-quantum cryptography in internet protocols: a case study of DNSSEC.” SIGCOMM Computer Communication Review, 50: 4, 49–57, doi: 10.1145/3431832.3431838.DOI: 10.1145/3431832.3431838Google Scholar
  10. S. Huque, C. Elmero, O. Guomundsson (2025). “Compact denial of existence in DNSSEC.” Active Internet-Draft. Available at: https://datatracker.ietf.org/doc/draft-ietf-dnsop-compact-denial-of-existence/07/, expires 31 August 2025.DOI: 10.17487/RFC9824Google Scholar
  11. M. Müller (2021). Making DNSSEC Future Proof, PhD Thesis - Research UT, graduation UT, University of Twente.Google Scholar
  12. W. Beullens (2022). Breaking Rainbow Takes a Weekend on a Laptop, Cryptology ePrint Archive, Paper 2022/214DOI: 10.1007/978-3-031-15979-4_16Google Scholar
  13. G. Alagic, D. Apon, D. Cooper, Q. Dang, T. Dang, J. Kelsey, J. Lichtinger, Y. Liu, C. Miller, D. Moody, R. Peralta, R. Perlner, A. Robinson, D. Smith-Tone (2022). “Status report on the third round of the NIST postquantum cryptography standardization process.” Available at: https://csrc.nist.gov/pubs/ir/8413/upd1/finalDOI: 10.6028/NIST.IR.8413Google Scholar
  14. G. Beernink (2022). “Taking the quantum leap: Preparing dnssec for post-quantum cryptography.” Master’s thesis, University of Twente.Google Scholar
  15. A. Fregly, R. van Rijswijk-Deij, M. Müller, P. Thomassen, C. Schutijser, and T. Chung (2024), Research Agenda for a Post-Quantum DNSSEC, Expired Internet-Draft, Available: https://datatracker.ietf.org/doc/draft-fregly-research-agenda-for-pqc-dnssec/, expired 26 June 2025.Google Scholar
  16. A. Fregly, R. van Rijswijk-Deij, M. Müller, P. Thomassen, C. Schutijser, and T. Chung (2024). “Research agenda for a post-quantum DNSSEC, expired internet-draft.” Available at: https://datatracker.ietf.org/doc/draft-fregly-research-agenda-for-pqc-dnssec/, expired 26 June 2025.Google Scholar
  17. J. Goertzen (2022). “Enabling post-quantum signatures in DNSSEC: one ARRF at a time,” Master’s thesis, University of Waterloo.Google Scholar
  18. M. Raavi, S. Wuther, S. Chang (2024). “Securing post-quantum DNSSEC against fragmentation mis-association threat”, in IEEE International Conference on Communications (ICC): Communication and Information System Security Symposium.DOI: 10.1109/ICC51166.2024.10622607Google Scholar
  19. SIDN Labs, [software]. Available at: https://github.com/SIDNGoogle Scholar
  20. IANA (2024). Domain Name System Security (DNSSEC) Algorithm Numbers, [web resource], Last updated: December 05. Available at: https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtmlGoogle Scholar
  21. P. Boryło, P. Chołda, J. Domżał, P. Jaglarz, P. Jurkiewicz, A. Lasoñ, M. Niemiec, M. Rzepka, G. Rzym, R. Wój-cik (2017). “SDNRoute: Integrated system supporting routing in software defined networks” in 19th International Conference on Transparent Optical Networks (ICTON), 2–6 July 2017, doi: 10.1109/IC-TON.2017.8024959DOI: 10.1109/ICTON.2017.8024959Google Scholar
  22. Tantalor93 (GitHub user). dnspyre—a command-line DNS benchmark tool [web resource]. Available at: https://tantalor93.github.io/dnspyre/Google Scholar
  23. SIDN Labs. PowerDNS recursive resolver with support for PQC algorithms [software]. Available at: https://github.com/SIDN/pqc-resolver-powerdnsGoogle Scholar
  24. SIDN Labs. PowerDNS authoritative nameserver with PQC algorithms [software]. Available at: https://github.com/SIDN/pqc-auth-powerdnsGoogle Scholar
  25. PowerDNS. PowerDNS authoritative server documentation: built-in webserver and HTTP API [web resource]. Available at: https://doc.powerdns.com/authoritative/http-api/index.htmlGoogle Scholar
  26. J. Goertzen, P. Thomassen, N. Wisiol (2024). Field experiments on post-quantum DNSSEC. Available at: https://ripe89.ripe.net/presentations/57-RIPE-89-Field-Experiments-on-Post-Quantum-DNSSEC.pdfGoogle Scholar
  27. PowerDNS. PowerDNS documentation [web resource]. Available at: https://doc.powerdns.com/(Accessed on 28 May 2025).Google Scholar