Greetings all, With the upcoming post-quantum DNSSEC DNSOP interim, I wanted to provide an update on the state of Merkle Tree Ladder (MTL) and how it can help to enable a post-quantum transition for DNSSEC.
As of today, we have two active drafts on MTL – a streamlined base [1] and new extension draft [2]. The base draft defines MTL with ML-DSA-44 and has each RRSIG response carry everything needed for validating a signature on an RRset using the zone’s DNSKEY just like existing DNSSEC algorithms including the ML-DSA draft [3]. These changes are geared towards implementation simplicity while still enabling potential space savings benefits for authoritative name server operators compared to non-MTL approaches as shown in [4]. The new extension draft defines an EDNS(0) option to enable clients to communicate their knowledge of an existing ML-DSA signature to a name server. If the specified signature is still valid, the server can avoid re-transmitting the potentially large PQ signature. The extension can provide bandwidth and transport related benefits as well as space savings for resolvers and clients who opt in to it. More broadly, MTL provides optionality for operators and promotes cryptographic agility. While the base draft is defined as using ML-DSA-44, the core concept can be readily applied to algorithms such as SLH-DSA or larger parameter sizes like ML-DSA-87. MTL ensures that when such algorithms are adopted, the operational impact can be reduced as operators can optimize the number of large PQC signatures they generate and store. Looking forward to discussing further at the interim, --Swapneel Sheth [1] – https://datatracker.ietf.org/doc/html/draft-kaizer-dnsop-ml-dsa-mtl-dnssec-02 [2] – https://datatracker.ietf.org/doc/html/draft-hdong-dnsop-ml-dsa-mtl-dnssec-sigtag-ext-00 [3] – https://datatracker.ietf.org/doc/html/draft-westerbaan-dnssec-mldsa-04 [4] – https://datatracker.ietf.org/meeting/126/materials/slides-126-hackathon-sessd-pqc-dnssec-mtl-benefits-00 On 9/30/26, 6:14 PM, "Benno Overeinder" <[email protected] <mailto:[email protected]>> wrote: Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Dear all, The DNSOP WG Virtual Meeting is scheduled for this Friday at 13:00 UTC. Please see the interim agenda below. Please note that I have provisionally made up the titles of the presentations, but they cover the essence of the matter. Meeting materials can also be found at: https://secure-web.cisco.com/15vlR0fkrgTEgRJO6dtUAXDROYYGL3xhDcx6C_IPE1MgJXZmEwodIKiw2f7eYEtCMw0Y3ars_jAMxe2RfCETGLdP5rnAfXriRknhOm_3T_zlrMwz_pFzZKfU_qGI2a1gPY2l1im4o4-Tp_Eb0V5BjuIPI3vnKDN4xceriF7r1-LyjQ0pKnc_oeMo6aRRpGumhFRBhaD9c57bN26HYFenwpeXCztS7V0Ql9UbiDBUGykVmru9hRjnmEni7XoGGDp_EkKib5CKcVfHmI-KUFfuiP6kGjAZcTwxVj0OfgWLrosE/https%3A%2F%2Fdatatracker.ietf.org%2Fmeeting%2Finterim-2026-dnsop-02%2Fsession%2Fdnsop <https://secure-web.cisco.com/15vlR0fkrgTEgRJO6dtUAXDROYYGL3xhDcx6C_IPE1MgJXZmEwodIKiw2f7eYEtCMw0Y3ars_jAMxe2RfCETGLdP5rnAfXriRknhOm_3T_zlrMwz_pFzZKfU_qGI2a1gPY2l1im4o4-Tp_Eb0V5BjuIPI3vnKDN4xceriF7r1-LyjQ0pKnc_oeMo6aRRpGumhFRBhaD9c57bN26HYFenwpeXCztS7V0Ql9UbiDBUGykVmru9hRjnmEni7XoGGDp_EkKib5CKcVfHmI-KUFfuiP6kGjAZcTwxVj0OfgWLrosE/https%3A%2F%2Fdatatracker.ietf.org%2Fmeeting%2Finterim-2026-dnsop-02%2Fsession%2Fdnsop> Best regards, -- Benno # DNS Operations (DNSOP) Working Group ## interim-2026-dnsop-02 ### Chairs * Benno Overeinder [[email protected] <mailto:[email protected]>](mailto:[email protected] <mailto:[email protected]>) * Ondrej Sury [[email protected] <mailto:[email protected]>](mailto:[email protected] <mailto:[email protected]>) ### Secretaries * Peter Thomassen <[email protected] <mailto:[email protected]>> * Shumon Huque <[email protected] <mailto:[email protected]>> ### Technical Advisor * Jim Reid [[email protected] <mailto:[email protected]>](mailto:[email protected] <mailto:[email protected]>) ### Responsible Area Director * Mohamed Boucadair [[email protected] <mailto:[email protected]>](mailto:[email protected] <mailto:[email protected]>) ### Document Status * [Github](https://github.com/ietf-wg-dnsop/wg-materials/blob/main/dnsop-document-status.md <https://github.com/ietf-wg-dnsop/wg-materials/blob/main/dnsop-document-status.md>) * [Datatracker](https://secure-web.cisco.com/17KvPk316vOqQ-pmOI9SFqmfojUPD1jY2n5Gyryhr49u1UaKgOXt7CUcXW7WlaBqhfpIR32jFN7R8YJlNjdiRFh0hvUfyuuhU0ElPRlyCEfAz_h5mHDixQLycxxSrCJknjwXVFhQu0OWfDKDC2PTrlRFSuHw0XEC9bRyknxAo441gnEhHX8lkHr7P_1Oh4IMtbMnJAgBJDg22H4kF-b1MIZs55rLXdDnM8fRunZvG1VTvWjmcwvbvzI-ztVr8fz7iRhiV-t7x3KMDxR8074AEOYoTnZFjsoJ2CxCYlbK_Duc/https%3A%2F%2Fdatatracker.ietf.org%2Fwg%2Fdnsop%2Fdocuments%2F <https://secure-web.cisco.com/17KvPk316vOqQ-pmOI9SFqmfojUPD1jY2n5Gyryhr49u1UaKgOXt7CUcXW7WlaBqhfpIR32jFN7R8YJlNjdiRFh0hvUfyuuhU0ElPRlyCEfAz_h5mHDixQLycxxSrCJknjwXVFhQu0OWfDKDC2PTrlRFSuHw0XEC9bRyknxAo441gnEhHX8lkHr7P_1Oh4IMtbMnJAgBJDg22H4kF-b1MIZs55rLXdDnM8fRunZvG1VTvWjmcwvbvzI-ztVr8fz7iRhiV-t7x3KMDxR8074AEOYoTnZFjsoJ2CxCYlbK_Duc/https%3A%2F%2Fdatatracker.ietf.org%2Fwg%2Fdnsop%2Fdocuments%2F>) ### Social Media * [Bluesky @ietf-wg-dnsop.bsky.social](https://secure-web.cisco.com/1YKFBqbH9pgUKsle--17uWAvx6ehiFXTLn5cto-74KAlODcf7fJGuedIEz62jGsAwtQHRxztDW063egX4p-vfHVxQPeT0iMtvFG_wXkN7ty50E31nwPhUTk4xW_VDUK5zcTnJzeFo5KMoiTpmNKapZkElFZ_Ympe9YkDYDRFLr6MzIExIltSZW2FjmgsNsVMSPn7zjL8JNEybCD7JmaiaI_zJ7vRB1Vnfb9vVsB5sLFOCZwwcsShMgkqQUgL9sIBXj7CY7F3Y_lHTj2Ml5aHrZ_zE8v88he2MxmdvPBRY3xo/https%3A%2F%2Fbsky.app%2Fprofile%2Fietf-wg-dnsop.bsky.social <https://secure-web.cisco.com/1YKFBqbH9pgUKsle--17uWAvx6ehiFXTLn5cto-74KAlODcf7fJGuedIEz62jGsAwtQHRxztDW063egX4p-vfHVxQPeT0iMtvFG_wXkN7ty50E31nwPhUTk4xW_VDUK5zcTnJzeFo5KMoiTpmNKapZkElFZ_Ympe9YkDYDRFLr6MzIExIltSZW2FjmgsNsVMSPn7zjL8JNEybCD7JmaiaI_zJ7vRB1Vnfb9vVsB5sLFOCZwwcsShMgkqQUgL9sIBXj7CY7F3Y_lHTj2Ml5aHrZ_zE8v88he2MxmdvPBRY3xo/https%3A%2F%2Fbsky.app%2Fprofile%2Fietf-wg-dnsop.bsky.social>) * [Mastodon @[email protected] <mailto:[email protected]>](https://secure-web.cisco.com/11VCb08EQg3lKufcre9hKqZ1k61H0JTquY4nEBa_qir45lH8Ecq_-AJ3lLuzEjCe45yh5233SG1RhbOhNl6hy7w8eslxFwsIh8xoynku1Szu7Qs2fVOEa3aeVntcR71wUWH5meQtdBV_kSWfBw2qFYRLoN-Um3czaiZwghYhl6J4JKFdCO6tic0GpL2Qw7we-k8CYxg6fGbzwY9XH61bh0ErilqNXN6DqyVXI88-O-jBCCR_wpRKX4grTqd0fKawhrFB8nMmS0yvVI85hdrw0tQ4OO4S2YP0e-UU_4K0TBX4/https%3A%2F%2Fhachyderm.io%2F%40ietf_wg_dnsop <https://secure-web.cisco.com/11VCb08EQg3lKufcre9hKqZ1k61H0JTquY4nEBa_qir45lH8Ecq_-AJ3lLuzEjCe45yh5233SG1RhbOhNl6hy7w8eslxFwsIh8xoynku1Szu7Qs2fVOEa3aeVntcR71wUWH5meQtdBV_kSWfBw2qFYRLoN-Um3czaiZwghYhl6J4JKFdCO6tic0GpL2Qw7we-k8CYxg6fGbzwY9XH61bh0ErilqNXN6DqyVXI88-O-jBCCR_wpRKX4grTqd0fKawhrFB8nMmS0yvVI85hdrw0tQ4OO4S2YP0e-UU_4K0TBX4/https%3A%2F%2Fhachyderm.io%2F%40ietf_wg_dnsop>) ## Session interim-2026-dnsop-01 * Date: 2 October 2026 * Time: 13:00-14:00 UTC * [MeetEcho](https://secure-web.cisco.com/1SSXYY4a5U_088RLWghISd4yZTQNh4tSIUQIAehzFJS6hMF7Lm6ylsIG9UsGSeBbS2tJd_SSTNxF5o_QZSO1AsPvprYqHqdzoHp9TBdHad8-atBGLUAbrxoWbIGri9LGjKYtz_59_PNQL9MuIyHy8kFy4WX1SbY4QtiOQZ-lxqOLJhos5PWwEE-JeN0arvfs_rLgJhd0q15Dsh2w9P_xcdRg7KNFXEiVjQ_nFev1HOCz5_IC2caJnbSuHyvtUQ2foyC6gt0xXBcCmxcli9REvVd2ASgqefNdY7GpyEvKRZpM/https%3A%2F%2Fmeetings.conf.meetecho.com%2Finterim%2F%3Fsession%3D35900 <https://secure-web.cisco.com/1SSXYY4a5U_088RLWghISd4yZTQNh4tSIUQIAehzFJS6hMF7Lm6ylsIG9UsGSeBbS2tJd_SSTNxF5o_QZSO1AsPvprYqHqdzoHp9TBdHad8-atBGLUAbrxoWbIGri9LGjKYtz_59_PNQL9MuIyHy8kFy4WX1SbY4QtiOQZ-lxqOLJhos5PWwEE-JeN0arvfs_rLgJhd0q15Dsh2w9P_xcdRg7KNFXEiVjQ_nFev1HOCz5_IC2caJnbSuHyvtUQ2foyC6gt0xXBcCmxcli9REvVd2ASgqefNdY7GpyEvKRZpM/https%3A%2F%2Fmeetings.conf.meetecho.com%2Finterim%2F%3Fsession%3D35900>) * [Jabber]([email protected] <mailto:[email protected]>) * [Zulip](https://secure-web.cisco.com/1aY-tdFSul_prodzNWwLRxSXKMOX-kWKNgnghUSsccJhMFdLKUU664kmZI7HKFA8VhOSuphRmYQBHi0pKnOBcd5FPtFLIuCPp300I6o_Zb-CiIuCZGG2Gbxo5Xe7AXrHtrATj-1H6J_DQIX8ObJMw648pNSk8tqqCke6_b7MEF_0CqKd8GKU9QFolJdxZm_V57CorP4yHEa-gT8ltkRcKWsf7Tp3x2M3DHWQG3yigIhs68QrRVnOaFMksmCxRa7-igmoKUbQoqmJM_1z-yqIZzwrRYcrBv-YOirTnfl1Whh8/https%3A%2F%2Fzulip.ietf.org%2F%23narrow%2Fstream%2Fdnsop <https://secure-web.cisco.com/1aY-tdFSul_prodzNWwLRxSXKMOX-kWKNgnghUSsccJhMFdLKUU664kmZI7HKFA8VhOSuphRmYQBHi0pKnOBcd5FPtFLIuCPp300I6o_Zb-CiIuCZGG2Gbxo5Xe7AXrHtrATj-1H6J_DQIX8ObJMw648pNSk8tqqCke6_b7MEF_0CqKd8GKU9QFolJdxZm_V57CorP4yHEa-gT8ltkRcKWsf7Tp3x2M3DHWQG3yigIhs68QrRVnOaFMksmCxRa7-igmoKUbQoqmJM_1z-yqIZzwrRYcrBv-YOirTnfl1Whh8/https%3A%2F%2Fzulip.ietf.org%2F%23narrow%2Fstream%2Fdnsop>) * [Minutes](https://secure-web.cisco.com/1XZQQjQB3OqIUprtH696royzSqwpOhbQvZi8Xwh5sDhFzTT4ZIGYrzTyMck1plOH2A6ItbOjYEzee_jVojchYHtrJyytqnLw0Dw7tB6eQhIFp5p5_UH6mXGxKhEVTuts0XsxqAQYCZVMMIl9DNVUfIZnaranTH3ZCV0U10Ie6GXdSNInYWhNBELXBEy1cimnR_pAD3In0dSI-vs8OqtUs-pB1iGbQ1h9RGnKNLROiGozsPEGn1FIh_pcSeRUYFLV3k4toIbo6s_b0KsDGTDNg-Ynymi8Na3jSGzL23haC_eU/https%3A%2F%2Fnotes.ietf.org%2Fnotes-ietf-interim-2026-dnsop-02-dnsop <https://secure-web.cisco.com/1XZQQjQB3OqIUprtH696royzSqwpOhbQvZi8Xwh5sDhFzTT4ZIGYrzTyMck1plOH2A6ItbOjYEzee_jVojchYHtrJyytqnLw0Dw7tB6eQhIFp5p5_UH6mXGxKhEVTuts0XsxqAQYCZVMMIl9DNVUfIZnaranTH3ZCV0U10Ie6GXdSNInYWhNBELXBEy1cimnR_pAD3In0dSI-vs8OqtUs-pB1iGbQ1h9RGnKNLROiGozsPEGn1FIh_pcSeRUYFLV3k4toIbo6s_b0KsDGTDNg-Ynymi8Na3jSGzL23haC_eU/https%3A%2F%2Fnotes.ietf.org%2Fnotes-ietf-interim-2026-dnsop-02-dnsop>) ## Agenda ### Administrivia * Agenda Bashing, Note Well, etc, 5 min ### Presentation of PQ-DNSSEC activities and discussion * Post-quantum Cryptography for DNSSEC, a temporary view, 10 min - Paul Hoffman * ML-DSA at 1.1.1.1, 10 min - Bas Westerbaan * MTL-mode approach to PQ-DNSSEC, 10 min - Andrew Kayser * Preliminary Results of Measuring TCP Pressure on DNS Authoritative Servers, 10 min - Paul Hoffman * Open discussion, 20 min - steps forward _______________________________________________ DNSOP mailing list -- [email protected] <mailto:[email protected]> To unsubscribe send an email to [email protected] <mailto:[email protected]> _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
