Google Enhances HTTPS Security with Quantum-Resistant Certificates

Google has announced a new initiative to secure HTTPS certificates against potential quantum computer attacks, which could compromise current encryption methods. This effort involves the use of Merkle Tree Certificates (MTCs) to ensure that the transition to quantum-resistant cryptography does not disrupt internet performance or accessibility.

The challenge lies in the fact that quantum-resistant cryptographic data is approximately 40 times larger than the classical cryptographic material currently used. Presently, a typical X.509 certificate chain includes elliptic curve signatures and public keys that total around 4 kilobytes. This data is vulnerable to quantum attacks using Shor's algorithm, which can break classical encryption.

To address this, Google and its partner Cloudflare are utilizing Merkle Trees, a data structure that efficiently verifies large amounts of information with minimal data. MTCs replace the traditional serialized chain of signatures with compact proofs, allowing a Certification Authority (CA) to sign a single 'Tree Head' for potentially millions of certificates. The browser then receives a lightweight proof of inclusion in this tree, significantly reducing the data size required for verification.

Google's approach also involves publishing all TLS certificates in public transparency logs, which are append-only distributed ledgers. This transparency ensures that website owners can verify that no unauthorized certificates have been issued for their domains. The move towards quantum-resistant algorithms, such as ML-DSA, aims to prevent forgeries by requiring an attacker to break both classical and post-quantum encryption.

The new system, already implemented in Chrome, is part of Google's broader strategy to develop a quantum-resistant root store, complementing the Chrome Root Store established in 2022. Cloudflare is currently testing the MTCs with around 1,000 TLS certificates, while the Internet Engineering Task Force's working group is coordinating with other stakeholders to create a long-term solution.

Google emphasizes the importance of adopting MTCs and a quantum-resistant root store to maintain the security and robustness of the internet's foundational infrastructure. By proactively designing for the demands of a modern internet, Google aims to accelerate the adoption of post-quantum resilience for all web users.