Exploring the Viability of Merkle Tree Certificates for Private PKIs

Merkle Tree Certificates are one of the most promising solutions to migrate the web public key infrastructure to post-quantum cryptography by 2030 without introducing prohibitive performance penalities. This solution avoids the latency introduced by huge quantum-resistant signatures and public keys by cleverly reducing the number of required signatures in a TLS handshake from five to one, with the so-called (signatureless) landmark-relative certificates. Removing the certificate chain introduces additional requirements for certificate authorities and web browsers. E.g., certificate authorities need to maintain an internal issuance log and web browsers need to periodically fetch and cache landmark subtree hashes. Google and Cloudflare are currently evaluating Merkle Tree Certificates on an Internet-scale experiment, and they both have publicly announced their interest in this approach to be fully quantum-safe by default by 2029. Although the IETF working group focuses on the Internet public key infrastructure, Merkle Tree Certificates might be a compelling option also for private public key infrastructures. In this poster, we detail the differences between a traditional Web PKI and one based on MTCs, identify the pain points that private public key infrastructure operators will face with this novel approach compared to the current Web PKI, and discuss some of the advantages and disadvantages of using Merkle Tree Certificates when migrating to post-quantum cryptography compared to e.g., simply replacing all traditional signatures with ML-DSA