Cloudflare adds post-quantum DNSSEC validation to 1.1.1.1

As noted by Cyber Insider, Cloudflare has taken a significant step towards future-proofing the internet's domain name system by adding support for post-quantum DNSSEC signature validation to its 1.1.1.1 public DNS resolver. This move is an early measure to protect DNS from potential threats posed by quantum computing.

Cloudflare is now validating signatures created with ML-DSA-44, a post-quantum algorithm standardized by NIST. This allows for testing post-quantum DNSSEC at internet scale before quantum computers can break current public-key cryptography. DNSSEC is crucial for preventing attackers from forging DNS responses and redirecting users to malicious sites. Cloudflare's 1.1.1.1 resolver checks cryptographic signatures to ensure DNS records are unaltered. A major challenge is the size of ML-DSA-44 signatures, which are significantly larger than current ones, potentially causing issues with UDP packet limits and requiring TCP retries. Another concern is avoiding downgrade attacks during the transition, where older signatures could be exploited.

Cloudflare addresses this by requiring a valid post-quantum validation path if DS records indicate ML-DSA-44 support. Broad deployment will require support across the entire DNS hierarchy, with Cloudflare aiming for full post-quantum security by 2029. Users of 1.1.1.1 do not need to take any action, as the validation is applied automatically.

Source: Cyber Insider