Paper 2024/1320 Original: eprint.iacr.org/2024/1320 ↗
Post-Quantum DNSSEC over UDP via QNAME-Based Fragmentation
Abstract
In a typical network, a DNS(SEC) message over 1232 bytes would either be fragmented into several UDP/IP packets or require a re-transmit over TCP. Unfortunately, IP fragmentation is considered unreliable and a non-trivial number of servers do not support TCP. We present $\texttt{QNAME}$-Based Fragmentation ($\mathsf{QBF}$): a DNS layer fragmentation scheme that fragments/re-assembles large post-quantum DNS(SEC) messages over UDP in just 1 round-trip while using only standard DNS records. Our experiments show that DNSSEC over $\mathsf{QBF}$, with either Falcon-512, Dilithium-2 or SPHINCS$^{+}$ as the zone signing algorithm, is practically as fast as the currently deployed ECDSA-P256 and RSA-2048 setups in resolving $\texttt{QTYPE}$ $\texttt{A}$ queries.
Metadata
- Available format(s)
PDF- Category
- Cryptographic protocols
- Publication info
- Preprint.
- History
- 2024-08-26: last updated
- 2024-08-23: published
- Short URL
- https://ia.cr/2024/1320
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2024/1320,
author = {Aditya Singh Rawat and Mahabir Prasad Jhanwar},
title = {Post-Quantum DNSSEC over UDP via QNAME-Based Fragmentation},
howpublished = {Cryptology {ePrint} Archive, Paper 2024/1320},
year = {2024},
url = {https://eprint.iacr.org/2024/1320}
}