pqconnect

> The advantage of PQConnect is that, once you have installed PQConnect on your computer, PQConnect automatically detects servers that support PQConnect, and transparently encrypts traffic to those servers. I mainly take issue with this claim of "automatically" detecting servers and magically doing post-quantum magic to your connections, magically. It seems to do so by noticing that DNS records for names are CNAMEs that match a format ("pq1" and then a 52-char b32-encoded hash), which it does by creating a netfilter rule for "udp sport 53" [0]. So, I guess if you don't have adversaries racing your DNS response packets, and you're not using dns-over-tls or dns-over-https, then the magic can work. One glaring problem with this kind of automatic, magic setup is that if you do have attackers, or if your system does dns in some newfangled way

There are a number (or just one? Mullvad) of commercial VPN providers that provide an optional PQC layer, and that fact is referenced on this project's page. There is also VPN software that incorporates PQC (also referenced): <https://rosenpass.eu> What this project attempts to do is to establish a transparent PQC stream between client and server. I'm not sure I like the way they are doing this, with a lot of magic (PQConnect inserts itself into the network stack to inspect incoming DNS responses) and with Python of all things.[1][2][3] I think the best way to do this is to graft it on top of QUIC and not mess with linux network plumbing. Perhaps integrate it with something like <https://github.com/n0-computer/iroh> [1] <https://www.pqconnect.net/pqconnect-20241206.pdf> [2] <https://www.pqconnect.net/20241227.pdf> [3] <https://github.com/