Cloudflare announced on Tuesday that it intends to become one of the first certificate authorities to issue quantum-safe TLS certificates. The infrastructure provider will utilize an open-source platform capable of generating both conventional TLS certificates and post-quantum alternatives known as Merkle Tree Certificates. These hybrid certificates will be available at no cost to all users, regardless of their payment status.
To support the deployment of this technology at scale, Cloudflare is acquiring a trusted certificate root from CA GlobalSign. The company stated that this acquisition will enable millions of websites to adopt post-quantum certificates with minimal effort and without incurring performance penalties. The initiative represents part of a broader transformation of the web public key infrastructure required to protect website encryption and authentication in an era when quantum computers may pose a threat to current cryptographic methods.
The technical challenge lies in developing quantum-proof signatures that can be efficiently transmitted during web communications and recorded in transparency logs while preventing the issuance of fraudulent certificates. A conventional approach of simply replacing existing algorithms would add approximately 40 times the current data volume needed for a TLS handshake, making such a solution impractical. In response, Google proposed a solution using Merkle Trees in February, which reduces handshake data to approximately 40 kilobytes—comparable to current levels. Cloudflare and Google have been testing this design through limited pilot programs.
Merkle Trees function as hierarchical data structures that verify large datasets using cryptographic hashes while requiring only a small fraction of the original data. Rather than replacing quantum-vulnerable signatures in the existing chain with quantum-resistant alternatives, the system replaces entire chains with compact Merkle Tree proofs. Certificate authorities sign only a single tree head representing millions of certificates, with browsers typically handling lightweight “landmarks” that confirm a certificate’s location within the tree.
Cloudflare’s implementation incorporates additional components, including the Automated Certificate Management Environment for streamlined certificate issuance and renewal. The company expects to commence issuing quantum-resistant certificates in the first quarter of 2027, though it emphasized that the transition will require coordinated efforts across the broader internet infrastructure community.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI