Recording signatures against a later break¶

Attack pattern¶

DNSSEC publishes its own evidence. Every RRSIG and every DNSKEY is served to anyone who asks, which makes collection free, silent, and invisible to the zone being collected. The patient attack is not decryption, because nothing here is encrypted. It is forgery held in reserve: record the signatures a zone produces today, and reproduce them the day the algorithm underneath stops holding. Signature size is what makes the replacement awkward, since post-quantum schemes are large and DNS responses already fight fragmentation and truncation at their current size. That leaves the transition as the exposed period, where a zone carrying both a classical and a replacement algorithm is worth exactly whichever one a resolver is willing to accept.

1. Post-Quantum Threats [OR]

    1.1 Cryptographic Harvesting [AND]

        1.1.1 DNSSEC signature capture for later forgery [OR]
            1.1.1.1 Record ECDSA-P256 signatures to forge once P-256 breaks
            1.1.1.2 Record RSA-2048 DNSKEYs to forge once RSA breaks
            1.1.1.3 NSEC3 chain enumeration

        1.1.2 Quantum Decryption Preparation [OR]
            1.1.2.1 Long-term encrypted data storage
            1.1.2.2 Future decryption capability planning
            1.1.2.3 Harvest-then-decrypt campaigns

        1.1.3 Transition Period Exploitation [OR]
            1.1.3.1 Algorithm confusion attacks
            1.1.3.2 Hybrid scheme weaknesses
            1.1.3.3 Backward compatibility exploitation

Nothing is decrypted¶

• DNSSEC signatures and keys are published by design. Collecting them requires no access and leaves nothing behind on the zone.

• The threat is forgery rather than disclosure. A recorded RRSIG is not something to decrypt later; it is something to reproduce once the algorithm beneath it falls.

• Captured DoH and DoT traffic is the one part of this branch where harvest-then-decrypt applies in its usual sense, and it is a separate problem from the signatures.

• Signature size binds any replacement. Post-quantum schemes are large, and DNS responses already struggle against fragmentation and truncation at present sizes.

• Transitions are the exposed window. While a zone carries both a classical and a replacement algorithm, the weaker one decides for every resolver that still accepts it.

• The window is long and somebody else sets its end. A zone signed today with a key expected to outlive the algorithm has already been recorded by anyone who thought it worth the disk.