An Evaluation of PQC Algorithms in DNSSEC Using Real-World Data

Over the last years, we have conducted a series of experiments to establish which PQC algorithms would be best suitable for replacing RSA and ECDSA in DNSSEC, the security extension of DNS. As a core internet protocol, it is important that DNS remains working securely when powerful quantum computers exist. DNS contains data that fits in a single small UDP packet, which is fast and reliable, or switches to a slower TCP connection for bigger packets, which uses more resources on the server side. Small signatures and public keys are therefore preferred.

We present insights from our experiments after implementing PQC in the toolchain of DNSSEC, and testing PQC algorithms using real-world data from a top-level-domain operator and a large DNS resolver operator. Using real-world data allows us to measure the real impact of PQC algorithms on both client and server performance.