JA EN
shiichan

Post-Quantum Signatures Are 40x Bigger: Merkle Tree Certificates to the Rescue

Cloudflare Blog ★★★ View Markdown
#cloudflare#security#science

Hi everyone, it's Shii-chan!

Cloudflare Blog blog.cloudflare.com

Post-quantum cryptography is great for security, but the size is a real headache. Today's topic is Merkle Tree Certificates (MTCs), which aim to fix that!

What was announced?

The Cloudflare Blog published a technical explanation that Cloudflare's new certificate authority will support MTC issuance. MTC is a draft specification from the IETF PLANTS working group, with broad support across the industry.

Why it matters

Post-quantum signatures are roughly 40 times larger than classical ones. Used as-is in certificate chains, they would inflate TLS handshakes and balloon the data that Certificate Transparency (CT) logs need to store by 40x. To reach the post-quantum migration goal of 2029, something has to make this lighter.

What changes

  • Instead of signing every certificate, the CA signs the tree root, so less data is sent
  • Issuance and logging are coupled, so transparency is part of the design, not an add-on
  • Cloudflare's CA plans to support MTC issuance at no cost

Dive Deep

Here is how it works. A CA batches certificates into an append-only Merkle tree and signs the tree root. Clients verify a certificate with a compact inclusion proof, a sequence of hashes, against a signed tree head.

There are two forms of certificate.

  • Standalone: the signature holds a cosigned tree head and an inclusion proof
  • Landmark-relative: when clients obtain tree heads out-of-band, the signature holds only a lightweight inclusion proof

With landmark-relative certificates, you send one public key, one signature, and one inclusion proof of less than 1 kB.

In practice, a Chrome Beta 146 experiment served billions of MTCs, and landmark MTCs were 9% faster than a classical signature chain. The experiment concluded in August 2026.

Here is Cloudflare's plan for its CA.

  • Fork Let's Encrypt's Boulder ACME software
  • Operate mirroring cosigners using Azul, its open-source Rust-based transparency log
  • Require at least one independent cosignature, per Chrome policy
  • Go through Chrome's rigorous evaluation before full deployment

The target for inclusion in Chrome's Quantum-resistant Root Store is early 2027.

Wrap-up

  • Post-quantum signatures are about 40x larger and bloat handshakes and CT logs
  • MTCs sign the tree root and verify with an inclusion proof under 1 kB
  • The Chrome Beta 146 experiment served billions of MTCs and was 9% faster than classical chains
  • Cloudflare's CA will issue MTCs for free, using a Boulder fork and Azul

This is for anyone working on certificates who cares about both TLS performance and post-quantum migration!

Related posts