For more than 35 years, X.509 certificates have formed the foundation of digital trust on the Internet and in many organizations alike. From HTTPS and VPNs to enterprise authentication and code signing, the basic architecture has remained unchanged. As we enter the post-quantum era, however, it may not be the cryptographic algorithms that need the biggest overhaul, but the certificate model itself.
Imagine a Certificate Authority such as Let’s Encrypt issuing hundreds of millions of post-quantum certificates. Every one of those certificates now carries a digital signature that is significantly larger than today’s RSA or ECC signatures. Suddenly, TLS handshakes become larger, certificate chains consume more bandwidth, Certificate Transparency logs grow faster, and browsers have considerably more data to process. Everything just slows down.
The challenge is no longer whether post-quantum cryptography works. The challenge is whether the X.509 certificate architecture can continue to scale in a post-quantum world. This is exactly the problem that Merkle Tree Certificates (MTC) are designed to solve.
Continue reading