As quantum computing continues to mature, there is a looming concern that current forms of encryption could potentially be at risk. That concern has led to the ongoing development of quantum-safe encryption.

Domain name system (DNS), which is the root of all internet traffic, is one of the most fundamental areas of networking and it too could potentially be at risk in a post-quantum era. It's a challenge that internet infrastructure company Verisign is taking aim at solving with a series of efforts. Verisign manages the dot com domain registry as well as a pair of the primary authoritative root servers that power the modern internet.

Verisign recently announced several new contributions to help the internet community prepare for a future with quantum computing. This includes an open source implementation of their Merkle Tree Ladder (MTL) mode technique. MTL mode was developed by researchers at Verisign to reduce the impact of large cryptographic signatures needed to secure communications in a post-quantum world.

In tandem with the open source release, Verisign also published an Internet-Draft specification on using MTL mode signatures with DNSSEC. It provides guidance on key generation, signing, and verification in MTL mode. Verisign considers this an example of how MTL mode could help realize their "Research Agenda for a Post-Quantum DNSSEC."

"Our primary goal is to ensure long-term cryptographic resilience for DNSSEC, and thus for the ability to authenticate data published in the global DNS," Verisign spokesperson David McGuire told SDxCentral.

DNSSEC (DNS security) provides a degree of cryptographic assurance to a DNS record via an encrypted signing process.

The new Verisign approach works by signing structures called Merkle tree ladders derived from messages, rather than signing each message individually. The ladder signatures can be reused across multiple messages, spreading computational and size costs.

McGuire commented that the post-quantum algorithms currently being considered for deployment in the industry often have different operational characteristics than the cryptographic algorithms of the past.  For example, the sizes of digital signatures and the cost of computing them may be much larger than their pre-quantum counterparts.  Additionally, as a global internet infrastructure service, DNS has certain unique operational requirements that may be impacted by the new algorithms.

"As post-quantum algorithms begin to be standardized, and as organizations start to add them to their deployments in other uses, we want to be sure that the DNSSEC use case has suitable post-quantum options available as well," he said.

Verisign chose to implement MTL mode with the SPHINCS+ post-quantum signature algorithm. SPHINCS+ is being standardized by NIST as a conservative hash-based algorithm resistant to quantum attacks.

Directly using post-quantum signatures like SPHINCS+ in systems like DNSSEC would substantially increase signature sizes. MTL mode provides a way to gain post-quantum security while mitigating this size impact.

It's important to note that MTL mode is currently in the research and development stage with a view toward eventual standardization. Verisign recently updated the DNSSEC algorithm it uses to sign domain names in the .com, .net, and .edu zones, changing from one classical (non-post-quantum) algorithm to another.  That  experience with the algorithm rollover will provide a helpful framework for planning future updates.

"We are currently evaluating options for a future update to a post-quantum algorithm and how MTL mode could play a role, but we do not yet have a timeframe for such a change," McGuire said.