[DNSOP] Re: PQ DNSSEC?

[Sophie Schmieg <[e-mail]>]

In particular, it is hard to overstate the confidence gap cryptographers
have between the lattice based schemes (sans HAWK) and the rest of PQ
signature schemes (including HAWK). Pretty much any path to PQC DNSSEC
before 2030 requires the use of ML-DSA in order to be secure, and any hope
of having a solution before 2035 requires ML-DSA or FN-DSA, assuming
SLH-DSA or FAEST are out of the question. Code based cryptography arguably
comes somewhat close in confidence, but that family does not currently have
any signature candidates. Unfortunately, this confidence is based on
decades of existing research, and while the other schemes currently
evaluated by NIST are interesting, we are at least a decade out from being
able to trust them.

On Fri, Jul 24, 2026 at 5:08 AM Bas Westerbaan <bas=
[e-mail]> wrote:

>
>
> On Mon, Jul 20, 2026 at 2:52 AM Watson Ladd <[e-mail]> wrote:
>
>> Since singing is designed to be offline, and verification doesn't
>> actually matter, and size does, SQISign is the obvious choice. We know
>> verification doesn't matter given people regularly turn it off rather
>> than fail closed when verification is failing.
>>
>
> Yesterday a new attack against SQIsign was published [1], and it was
> acknowledged by the SQIsign designers [2]. It doesn't break SQIsign
> completely, but it looks like they'll have to change parameters. It'll take
> some time to figure out by how much. This attack is not a surprise: SQIsign
> and the other appealing signature schemes in the on-ramp competition just
> need more time for proper evaluation.
>
> Best,
>
>  Bas
>
>
> [1] https://eprint.iacr.org/2026/1486
> [2]
> https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/TVIAOVbYP1w/m/K9_etUqkBwAJ
> _______________________________________________
> DNSOP mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>


-- 

Sophie Schmieg | Information Security Engineer | ISE Crypto |
[e-mail]