Building a post-quantum certificate authority with Merkle Tree Certificates

What happened

Building a post-quantum certificate authority with Merkle Tree Certificates, Cloudflare Blog announced. As post-quantum signatures threaten to inflate TLS handshakes and certificate transparency logs, Merkle Tree Certificates offer a path to compact, auditable authentication. The Web Public Key Infrastructure (Web PKI) is the complex and distributed ecosystem of policies, protocols, and infrastructure operators that helps you trust that you’re not being misdirected to an incorrect or malicious website.

In the past few decades, this ecosystem has undergone significant changes. One is the addition of transparency: the now-mandatory requirement that all certificates be logged in public certificate transparency logs.

This transition is not straightforward: simply swapping post-quantum cryptography into certificates at Internet scale would lead to unacceptable performance degradation. After gaining broad support across the industry, Merkle Tree Certificates (MTCs) have emerged as the path forward.