Technologists are worried about the risks to encrypted data that travels over current web protocols, but a new infrastructure proposed by an internet standards group could protect against quantum attacks in the future This article explores post quantum certificates. . Cryptographically-relevant quantum computers (CRQCs) could let people decrypt secure traffic that uses HTTPS and fake secure servers.
To make the internet safer with the structures we use today, we need to use post-quantum algorithms, which come with big trade-offs. Browser makers have already added to the current Transport Layer Security (TLS) standard to protect communications from the biggest quantum threat of the present: "store now, decrypt later" (SNDL) threats, in which an enemy steals data to use when quantum computing becomes available.
But the technology doesn't fix other security problems that will come up in the future. The tree can quickly tell if data has changed and, if it has, in which data block, thanks to the data structure. Related: Native Launches With Security Control Plane for Multicloud Merkle tree certificates use this same method.
MTCs not only make post-quantum certificates smaller, but they also make them faster and include transparency as a feature, not an extra requirement. Using other post-quantum alternatives, like ML-DSA, to authenticate servers adds a lot of extra work.
Brian Trzupek, senior vice president of product at certificate authority DigiCert, says that right now, loading the certificate from a page view on a site takes 3.1 KB per connection. But with ML-DSA, that number would rise to 14.7 KB per connection. Also, the IETF draft specification says that old entries can be thrown away once they have expired without making the logs invalid.
Internet infrastructure providers will probably need to update their software and do a lot of testing to make sure that the internet's "middle boxes" don't block MTCs. People who use browsers, on the other hand, shouldn't notice the change. According to Google researchers, website managers shouldn't have to do much more than update to the latest version of their favorite web server.
They said in an email, "Our deployment strategy makes sure that the use of MTCs won't break websites, even if they don't actively adopt MTCs."
