View Code? Open in Web Editor NEW

PQC-enabled Bind9 using Open Quantum Safe's oqs-provider.

License: Mozilla Public License 2.0

Shell 16.94% C++ 0.02% Python 2.14% Perl 1.59% C 77.72% Emacs Lisp 0.03% XSLT 0.25% Makefile 0.37% XS 0.03% DTrace 0.02% DIGITAL Command Language 0.01% M4 0.82% GDB 0.01% Roff 0.03% SmPL 0.01% SWIG 0.04% Jinja 0.01%

oqs-bind's Introduction

OQS-Bind

OQS-Bind is a forked version of ISC's Bind9 DNS software which enables PQC DNS. The original Bind9 README can be found here. This fork take advantage of Open Quantum Safe's liboqs and oqs-provider. NOTE: OpenSSL 3.2 is REQUIRED to build and use OQS-Bind.

This project is not officially affiliated with Open Quantum Safe.

Algorithms

Currently only DNSSEC is supported and tested with a small number of algorithms, but DoT and DoH inprinciple should work. I plan on eventually enabling more DNSSEC quantum resistant algorithms in the future and automating enabling and disabling them, but for now this must be done by hand. The algorithms we support in DNSSEC are as follows:

DNSSEC Algorithms

Algorithm	DNSSEC Algorithm ID
Falcon-512	17
Dilithium2	18
SPHINCS+-SHA-256-128s Simple	19
XMSS	20
XMSSMT	21

We opted to start the algorithm IDs at 17 because of the discussion seen here.

DoT/DoH Algorithms

These have not been tested, but in principle all algorithms supported by oqs-proivder should work.

Building

In order to build OQS-Bind, some version of OpenSSL 3.2 must be installed. At the time of writing Beta1 just was released, so it is recommended to not use OpenSSL 3.2 as your primary system-wide instalation of OpenSSL. Instead, installed OpenSSL 3.2 in a special location. You can then specify the location of OpenSSL 3.2 using the --with-openssl=<OPENSSL3.2DIR>. Then simply follow the regular Bind9 build instructions found here.

oqs-bind's People