Paper 2024/1319

Quantum-safe Signatureless DNSSEC

Abstract

We present $\mathsf{SL}\mathsf{\text{-}}\mathsf{DNSSEC}$: a backward-compatible protocol that leverages a quantum-safe KEM and a MAC to perform signature-less $\mathsf{(}\mathsf{SL}\mathsf{)}$ DNSSEC validations in a single UDP query/response style. Our experiments targeting NIST level I security for QTYPE A query resolution show that $\mathsf{SL}\mathsf{\text{-}}\mathsf{DNSSEC}$ is practically equivalent to the presently deployed RSA-2048 in terms of bandwidth usage and resolution speeds. Compared to post-quantum signatures, $\mathsf{SL}\mathsf{\text{-}}\mathsf{DNSSEC}$ reduces bandwidth consumption and resolution times by up to $95\mathrm{\%}$ and $60\mathrm{\%}$, respectively. Moreover, with response size $<$ query size $\le 1232$ bytes, $\mathsf{SL}\mathsf{\text{-}}\mathsf{DNSSEC}$ obviates the long-standing issues of IP fragmentation, TCP re-transmits and DDoS amplification attacks.