Integration of PQC in DNSSEC

[hugomayer57]

Hello,

First, thank you for your work on ldns and the broader DNS infrastructure. We are currently exploring post-quantum cryptography (PQC) in the context of DNSSEC .

Our goal is to patch ldns in order to:

• Integrate support for various PQC algorithms
• Perform tests regarding their feasibility for DNSSEC (e.g., key/signature size impact, resolver compatibility, fallback to TCP, etc.)
• Evaluate performance (signature/verification) and compatibility with the DNSKEY/RRSIG formats

As such, I’d like to ask:

• Have you already considered or experimented with PQC support in ldns ?
• Is there any ongoing or planned work in this area within NLnetLabs?

Thanks in advance!