# NLnet Labs A Dutch nonprofit that writes the open-source software behind the internet's core: DNS and routing.^[https://nlnetlabs.nl/about/] - Stichting (foundation) in Amsterdam Science Park. Founded 1999.^[https://nlnetlabs.nl/history/] - 15 staff: 11 engineers, 2 researchers. Co-chairs the IETF DNS Operations working group. - Funded by industry donations, support contracts and paid feature development. Reserves cover two years. - All new projects are in Rust since ~2020.^[https://blog.nlnetlabs.nl/] - Users include RIPE NCC, ICANN, Verisign, Let's Encrypt, AWS, Google, Meta, Equinix, SIDN.^[https://nlnetlabs.nl/] - NSD was built for root servers. It ran on the K and L roots. ## Where the products sit | Layer | Job | Products | |---|---|---| | Naming: resolve | Answer "where is X?" for users | **Unbound** (validating recursive resolver) | | Naming: publish | Serve your zones | **NSD** (authoritative server) | | Naming: trust | Sign zones with DNSSEC | **Cascade** (signer, Rust). Replaces OpenDNSSEC, end-of-life Oct 2027 | | Naming: build | Libraries and tools | **domain** (Rust crate), **ldns** (C), **dnst**, **dnsi**, **mimir** (DNS proxy and load balancer) | | Routing: trust | Publish who may announce your IP space (RPKI) | **Krill** (RPKI Certificate Authority) | | Routing: verify | Check BGP routes against RPKI | **Routinator** (Relying Party), **RTRTR** | | Routing: observe | Collect and script BGP data | **Rotonda** (BGP platform), **Roto** (scripting language) | - They sit above the physical and switching layers. In the [[Open Source Hyperscaler MoC]] they live next to [[FRRouting (FRR)]] and [[PowerDNS]]. - Both halves solve one problem: *can I trust this name or this route?* That is a signature problem. ## Links to the quantum security stack **[[Post Quantum Cryptography|PQC]]: direct link.** - DNSSEC and RPKI both rely on RSA and ECDSA signatures. Shor's algorithm breaks both. - PQC signatures are big. ML-DSA-44 is 2,420 bytes. SLH-DSA-128s is 7,856 bytes. ECDSA P-256 is 64 bytes. - DNS answers over UDP should stay under ~1,232 bytes. Big signatures force fragmentation or TCP fallback. - Their 2020 paper with SIDN Labs studies this: *Retrofitting Post-Quantum Cryptography in Internet Protocols: a Case Study of DNSSEC* (ACM CCR).^[https://nlnetlabs.nl/research/publications/] - A second 2020 paper (IMC) shows DNSSEC algorithm changes take years. That is a [[Crypto-agility]] warning. - Cascade (signer) and Krill (CA) are where a PQC algorithm would land first. - Their site shows no PQC product work today. **QRNG: indirect link.** - DNSSEC and RPKI keys are long-lived roots of trust. Weak entropy at key generation breaks them silently. - Signers often keep keys in an [[Hardware Security Modules (HSM) MOC|HSM]]. A [[Quantum Randomness - Strengthening Cybersecurity with Unpredictability|QRNG]] can feed the HSM. - NLnet Labs has no RNG work. **[[QKD]]: no real link.** - QKD shares secret keys over a fibre link. DNS and BGP need public, verifiable signatures that anyone can check. QKD cannot do that. - See [[Security x Comms Protocols x Impact of QKD and PQC]]. What Navon could do with them: [[NLnet Labs x Navon]]. ---- tags: #boat #security links: [[Security MoC]] [[Navon MoC]] [[Post Quantum Cryptography]] [[Crypto-agility]] [[Open Source Hyperscaler MoC]]