Cloudflare announces plans for post-quantum certificate authority

Cloudflare Inc. announced plans to launch a public certificate authority that will issue post-quantum certificates designed to withstand future encryption-breaking quantum computers. The new authority will utilize Merkle Tree Certificates, a format co-authored by Cloudflare as an Internet Engineering Task Force draft specification, from the same system used for conventional certificates, with further coverage provided by Silicon Angle.

The move addresses the significant size increase in post-quantum certificates, with new algorithms producing signatures of 2,420 bytes compared to the 64 bytes of current elliptic curve schemes. Merkle Tree Certificates avoid sending large signatures with every connection by using a lightweight proof of the certificate's presence in a trusted public log for verification. Cloudflare aims to mitigate systemic risk associated with the concentration of certificate issuance among a few dominant providers. The company plans to acquire an established root certificate to ensure compatibility with older hardware and has applied to major browser root programs.

Operations will be transparent, featuring reproducible code builds and a public health dashboard. Site owners will manage both conventional and post-quantum certificates through a unified system, with RFC 9773 enabling background certificate renewal and revocation.

Source: