Let's Encrypt Post-Quantum Cryptography Migration

Let's Encrypt is initiating a transition to post-quantum cryptography (PQC) to ensure the long-term security of the Web PKI ecosystem. The primary mechanism for this migration is the adoption of Merkle Tree Certificates (MTCs), which replace traditional certificate chains of trust. traditional RSA and ECC certificates are vulnerable to cryptanalysis by a sufficiently powerful quantum computer.

The Shift to Merkle Tree Certificates (MTCs)

Let's Encrypt is moving toward a system where certificates are part of a published Merkle tree. This architectural shift provides two primary benefits: efficiency and inherent transparency.

Inherent Certificate Transparency

Unlike current Certificate Transparency (CT) systems, which are "bolted on" after issuance, MTCs make transparency a property of issuance itself. In the current system, certificates are issued by CAs and then logged separately with signatures (SCTs) that must be carried in the TLS handshake. With MTCs, a certificate cannot exist outside the the Merkle tree, meaning transparency is built-in by design.

Performance and Handshake Efficiency

Despite using post-quantum algorithms, the MTC handshake is designed to be more efficient than today's Web PKI handshake. In the common case, the authentication path consists of only one signature, one public key, and one inclusion proof, which results in a smaller overall data transfer during the TLS handshake compared to traditional certificate chains.

Critical Security Implications of Post-Quantum Migration

Post-quantum authentication is a critical priority because long-lived keys—such as root CAs, code-signing keys, and secure boot certificates—take years to migrate. The industry has often focused on the "Harvest Now, Decrypt Later" (HNDL) threat, which targets encrypted data. However, authentication signatures are equally urgent because a quantum forgery is operationally indistinguishable from a key leak or a library bug.

"The threat is dark: reactive migration against an unobservable trigger is structurally impossible. You may see a forged signature, a drained wallet, a failing certificate, and have no way to attribute it to quantum cryptanalysis."

Community Discussion and Technical Concerns

Technical experts and community members have raised several concerns regarding the implementation of the implementation of the new system:

Implementation Risks and Legacy Support

Some developers have noted that the risks associated with with the transition are significant. While MTCs remove decades of "cruft," they also remove decades of battle-testing and the ancillary tools that support traditional PKI. The transition will be a complex project requiring broad adoption across browsers and servers.

Batching and Provisioning Latency

There are concerns regarding the "batched approach" to certificate provisioning. If batches are executed too frequently, client databases may become too large to maintain; if they are executed too infrequently, users may experience delays in receiving their first certificate.

Trust and Algorithm Selection

Some community members have expressed skepticism regarding the push for new PQC algorithms, suggesting that these algorithms may be unproven or potentially backdoored by intelligence agencies, preferring to stick with established algorithms like Ed25519 or RSA.

Current CT System Flaws

Critics of the current Certificate Transparency system argue that it is a broken mess due to design flaws in RFC 6962, specifically regarding the difficulty of validating inclusion proofs and the reliance on trust in Apple and Google's log lists. There is a hope that MTCs will address or eradicate these fundamental design flaws.