# NLnet Labs x Navon [[NLnet Labs]] secures names and routes. Navon can make that layer part of a sovereign, quantum-ready data center. ## Use their software - **Resolver.** Run Unbound for tenants. Every lookup is DNSSEC-validated, on-site. No public resolver sees tenant traffic. - **Authoritative DNS.** Keep [[PowerDNS]] for API-driven tenant records. Use NSD for hardened public zones. - **Signing.** Sign Navon and tenant zones with Cascade. Keep keys in a Navon [[Hardware Security Modules (HSM) MOC|HSM]] seeded by a QRNG. - **Routing security.** A [[Data Embassies|data embassy]] or [[Navon Sovereign Vaults|Sovereign Vault]] needs its own IP space and ASN. - Krill publishes ROAs: which networks may announce Navon's prefixes. - Routinator feeds [[FRRouting (FRR)]] edge routers. They drop hijacked routes. - Rotonda watches BGP for hijacks of Navon prefixes. ## Sell it as a service - **Sovereign DNSSEC signing.** Governments and ccTLDs sign zones on in-country hardware, with HSM and QRNG keys. Fits [[Navon Security Offering]] pillars 2 and 3. - **PQC-ready trust layer.** Hybrid signing when PQC DNSSEC algorithms are standardised. See [[Hybrid Cryptography as the bridge to Post Quantum Security]]. - **Pitch.** EU nonprofit, BSD-licensed, no vendor lock-in. Used by root operators and RIRs. Easy to defend to a sovereign buyer. ## Work with them - **Support contract.** Their revenue model. Gives early security warnings under NDA and priority features. - **Paid feature work.** Fund a PQC or HSM/QRNG integration in Cascade or Krill. They take paid development. - **Testbed.** Host PQC DNSSEC and RPKI experiments in the [[Security Testbed Deployment MOC|Security Testbed]]. Real signature sizes, real resolvers, measured breakage. - **Research.** Joint paper on PQC in RPKI. Their 2020 work covered DNSSEC only. > [!question] Open questions > - Does Cascade support PKCS#11 HSMs today? > - Which IETF drafts for PQC DNSSEC algorithms are live? > - Does a sovereign client need Navon to be its own RIR member? ---- tags: #boat #security links: [[Navon MoC]] [[NLnet Labs]] [[Navon Security Offering]] [[Crypto-agility]]