Google quantum-proofs HTTPS by squeezing 2.5kB of data into 64-byte space
Google is adding quantum-resistant cryptographic material to TLS certificate transparency logs, using Merkle Trees and clever compression to keep certificate sizes at ~4KB while protecting against future quantum attacks.
The Threat
Once viable, Shor's algorithm could forge classical encryption signatures and break public keys in certificate transparency logs. An attacker could forge signed certificate timestamps, making browsers accept certificates that were never legitimately registered.
The Solution: MTCs + Post-Quantum Signatures
Google is adding material from quantum-resistant algorithms (ML-DSA) to certificate logs. Forgeries would then require breaking both classical and post-quantum encryption simultaneously.
Merkle Tree Certificates (MTCs) use Merkle Trees to provide quantum-resistant assurances that a certificate has been published, without adding the full length of new keys and hashes. Using compression techniques, MTCs remain at roughly the same 4KB size as current certificates.
Implementation
- Already implemented in Chrome
- Cloudflare enrolling ~1,000 TLS certificates for testing
- IETF formed the PKI, Logs, And Tree Signatures (PLANTS) working group for standardization
- Part of Google's "quantum-resistant root store" initiative
Context
Certificate transparency logs were created in response to the 2011 DigiNotar hack, which produced 500 counterfeit certificates used to spy on users. The new quantum-resistant layer ensures these logs remain trustworthy even in a post-quantum world.
Source: Ars Technica