标题： 在CoreDNS中实现和评估后量子DNSSEC 显示英文标题

标题： Implementing and Evaluating Post-Quantum DNSSEC in CoreDNS

摘要： 量子计算机的出现对依赖RSA和ECDSA算法的当前安全服务、应用和/或协议实现构成了重大威胁，例如DNSSEC，因为基于数因子分解或离散对数的公钥密码学容易受到量子攻击。 本文介绍了将后量子密码学(PQC)算法集成到CoreDNS中，以实现抗量子的DNSSEC功能。 我们开发了一个插件，使CoreDNS支持五种PQC签名算法族：ML-DSA、FALCON、SPHINCS+、MAYO和SNOVA。 我们的实现保持与现有DNS解析流程的兼容性，同时提供使用抗量子签名的实时签名。 已进行了基准测试，性能评估结果揭示了安全性和效率之间的显著权衡。 结果表明，尽管PQC算法引入了操作开销，但几个候选算法为将DNSSEC过渡到抗量子密码学提供了可行的折中方案。 显示英文摘要

摘要： The emergence of quantum computers poses a significant threat to current secure service, application and/or protocol implementations that rely on RSA and ECDSA algorithms, for instance DNSSEC, because public-key cryptography based on number factorization or discrete logarithm is vulnerable to quantum attacks. This paper presents the integration of post-quantum cryptographic (PQC) algorithms into CoreDNS to enable quantum-resistant DNSSEC functionality. We have developed a plugin that extends CoreDNS with support for five PQC signature algorithm families: ML-DSA, FALCON, SPHINCS+, MAYO, and SNOVA. Our implementation maintains compatibility with existing DNS resolution flows while providing on-the-fly signing using quantum-resistant signatures. A benchmark has been performed and performance evaluation results reveal significant trade-offs between security and efficiency. The results indicate that while PQC algorithms introduce operational overhead, several candidates offer viable compromises for transitioning DNSSEC to quantum-resistant cryptography.