Agentic data science with the Data Agent Kit
cloud.google.com·7h ago
Security
Cloudflare Blog·Sep 10·5 min read
1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
TL;DR
Cloudflare's 1.1.1.1 now supports ML-DSA-44, a post-quantum DNSSEC signature algorithm, marking a significant step towards securing DNS against future quantum threats. This implementation allows for testing the challenges of larger DNS responses while maintaining compatibility with older systems.
✦ Why It Matters
Test your systems for compatibility with post-quantum DNSSEC to prepare for future security needs.
Key Takeaways
- Enable ML-DSA-44 validation in your DNS resolver.
- Monitor the transition to post-quantum algorithms in your systems.
- Test DNS responses for size and compatibility issues.
- Collaborate with DNS operators to ensure secure migrations.
How It Works
1.1.1.1 validates DNSSEC signatures using ML-DSA-44, which is designed to withstand quantum computing threats. The resolver checks for valid post-quantum signatures while ensuring compatibility with older algorithms, preventing potential downgrade attacks.