Google is using clever math to quantum-proof HTTPS certificates

In a groundbreaking announcement, Google revealed its strategy to enhance the security of HTTPS certificates on its Chrome browser against potential threats posed by quantum computing. This ambitious initiative seeks to reinforce internet security without compromising user experience. The challenge is substantial: the quantum-resistant cryptographic data required for the transparent publication of TLS certificates is approximately 40 times larger than the traditional cryptographic materials currently in use. Presently, X.509 certificates are around 64 bytes, consisting of six elliptic curve signatures and two EC public keys. However, this existing framework is vulnerable to attacks via Shor’s algorithm, which is enabled by quantum computing. In contrast, the new quantum-resistant certificates will measure about 2.5 kilobytes. As users connect to websites, all this data must be efficiently transmitted. "The larger the certificate, the slower the handshake process, which risks alienating users," noted Bas Westerbaan, a principal research engineer at Cloudflare, collaborating with Google on this significant transition. He emphasized the importance of maintaining a seamless browsing experience, warning that users might opt-out of the new encryption if it hampers their online speed. Moreover, the considerable increase in data size may adversely affect 'middle boxes'—intermediary devices that facilitate communication between browsers and websites. To mitigate this issue, tech companies are exploring the use of Merkle Trees, a sophisticated data structure that employs cryptographic hashes. This method allows for the verification of extensive information sets while using a fraction of the resources typically required in standard public key infrastructure. The members of Google’s Chrome Secure Web and Networking Team explained that Merkle Tree Certificates simplify the traditional model by substituting the bulky serialized chain of signatures with compact proofs. In this innovative approach, a Certification Authority (CA) signs a single 'Tree Head' that can represent millions of certificates, and what gets sent to the browser is merely a lightweight proof of inclusion in that tree. This development marks a significant leap toward a more secure internet infrastructure as quantum computing continues to evolve.