1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
Cloudflare's 1.1.1.1 resolver now validates post-quantum DNSSEC signatures using ML-DSA-44, a 2,420-byte NIST algorithm, preparing DNS for post-quantum migration by 2029.
Cloudflare enabled 1.1.1.1 to validate DNSSEC signatures using ML-DSA-44 (algorithm 18), a NIST-standardized post-quantum signature with 1,312-byte public keys and 2,420-byte signatures, roughly 38x larger than ECDSA P-256. The large signatures exceed common DNS-over-UDP limits, forcing fallback to TCP and creating downgrade risks while conventional algorithms must be published alongside. Cloudflare cites the risk of a quantum computer breaking RSA/ECDSA signatures by 2030 and plans full post-quantum security by 2029.
- 1.1.1.1 now validates ML-DSA-44 post-quantum DNSSEC signatures at internet scale
- ML-DSA-44 signatures are 2,420 bytes, exceeding typical UDP payload limits
- Dual conventional and post-quantum signatures create potential downgrade paths
- Root zone quantum compromise would allow forging validation for any zone
- Full post-quantum DNSSEC security targeted for 2029
- Vendors
- Cloudflare
- Products
- 1.1.1.1
- Organizations
- NIST
- AI models
- ML-DSA-44
From the original article
8 min read at blog.cloudflare.com
1. 1. 1.
By Sebastiaan Neuteboom · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.