Considerations for Selecting Post-Quantum Algorithms for DNSSEC

Considerations for Selecting Post-Quantum Algorithms for DNSSEC This document lists many of the considerations that the DNS community needs to balance when it is deciding which post-quantum algorithms to standardize for DNSSEC. The list here is not meant to be exhaustive, nor are the items listed in any particular order. The various considerations are not all equal, and different parts of the DNS community may find some considerations more important than others. This list is a brief summary, and does not contain all the details of each consideration that might be important to each part of the DNS community. It is meant to help the DNS community remember the significant tradeoffs that need to be made when picking a post-quantum algorithm for DNSSEC.

Standardization Does an algorithm have to be standardized by the US NIST? If an algorithm isn't standardized by US NIST, what other standards bodies are aceptable?

Size of Records Some proposals have big public keys but acceptable-sized signatures. Some proposals have big signtures but acceptable-sized public keys. Some proposals have big signtures and big public keys. Proposed terminology for sizes of signatures: Tiny: <400 bytes (three fit comfortably in a UDP packet for NXDOMAIN responses) Small: 400-1400 bytes (one or two fit comfortably in a UDP packet) Large: 1400-3000 bytes (forces TCP) Jumbo: >3000 bytes (causes noticeable traffic size)

CPU Usage other than TCP Some proposals take much more effort than current algorithms to sign. Some proposals take much more effort than current algorithms to validate. Some proposals take much more effort than current algorithms both to sign and validate.

Changes Needed to the DNS Protocol Some proposals require changes to how resolvers get keys and/or signatures in order to be efficient. These changes require protocol changes that have to be rolled out with the proposed algorithms.

Likelihood of Inclusion in HSMs Some proposals are difficult to implement in HSM hardware. Some zones are required by policy to use hardware HSMs.

Amount and Assuredness of Cryptanalysis Some proposals are considered likely to be secure but have some worrisome aspects. For example, some proposals require very careful implementation of signing in order to not leak the private key. Determining the assuredness is very hard to quantify across the cryptographic community.