CybersecurityVulnerability Management

Google Accelerates Post-Quantum Cryptography Migration Plan

Analyst 207||Source: SecurityMag
Cryptographic researcher working with quantum computing and cryptography equipment at a modern lab bench.

"MTCs make the two inseparable," said Jason Soroko, Senior Fellow at Sectigo.

Earlier this month Google Cloud published a post-quantum cryptography (PQC) roadmap that aims for migration to PQC by 2029. The roadmap frames the migration around three concrete domains of risk and capability, and signals a clear architectural preference: pursue Merkle Tree Certificates (MTCs) with Cloudflare rather than attempting to put large post-quantum signatures directly into X.509 certificates.

Google Cloud's 2029 post-quantum migration target

The roadmap sets a target of migration to post-quantum cryptography by 2029 and organizes the effort around three domains: defending today’s encrypted data against adversaries operating with a "harvest now, decrypt later" mindset; securing digital signatures to protect against falsified data and identities; and constructing systems capable of adapting to new cryptographic standards with minimal effort.

Merkle Tree Certificates with Cloudflare

Google, in cooperation with Cloudflare, is pursuing Merkle Tree Certificates rather than inserting post-quantum signatures into existing X.509 certificate formats. Jason Soroko explains that cryptographers at Google and Cloudflare, with contributions from Sectigo, are developing an approach that "does not force large post-quantum signatures into an infrastructure that wasn't designed for them." MTCs rethink how certificates are built and delivered for the post-quantum era.

Performance: keeping TLS handshakes fast

Soroko argues that PKI and fast, constant TLS handshakes are ubiquitous across cloud applications, AI-driven workloads, and billions of connected devices, and that degrading handshake performance would be felt widely. The roadmap and Sectigo’s analysis call out a central tradeoff: "Forcing traditional post-quantum signatures onto public websites would balloon handshake sizes and degrade the user experience, especially on mobile and high-latency connections." MTCs aim to sidestep that outcome by "replac[ing] multiple large signatures with one compact inclusion proof, holding overhead close to what users experience today." The promise, as described in the source material, is quantum resistance beneath a user experience that remains "fast, and uninterrupted."

Transparency: logging as certificate creation

The roadmap and Sectigo emphasize a second design shift: fold transparency into certificate creation. As Soroko notes, in today's PKI "Certificate Transparency (CT) logging is bolted onto the side of issuance as a separate step," which leaves room for certificates to exist "out in the wild unnoticed" when logging fails. MTCs invert that relationship so that "the act of creating a certificate is the act of logging it." In the MTC model, "If a certificate is not in the tree, it simply does not exist," making visibility and auditability intrinsic to authentication in a post-quantum world.

How browsers, enterprises, and security teams will respond

  • Browsers: The source reports that browsers "have signaled that MTCs are their preferred path for bringing post-quantum certificates to the public web," and that feasibility experiments are "already running against live internet traffic."
  • Enterprises and procurement leaders: Sectigo says organizations should monitor "NIST-standardized algorithms such as ML-DSA," evolving IETF specifications, browser roadmap decisions, and "enterprise adoption requirements" as they plan migrations and procurement timelines tied to the 2029 goal.
  • Technologists and security teams: The roadmap's three-domain framing places an explicit operational priority on defending against "harvest now, decrypt later" collection, protecting signatures and identities, and building systems with "visibility, automation, and crypto agility to adapt as standards mature."

Sectigo calls MTCs "the most promising route to post-quantum authentication that preserves the performance and scalability organizations depend on today," while also noting that "the full scope of what MTCs can do is still coming into focus." The roadmap therefore sets a clear deadline and a preferred technical path, but it also places a premium on continued experimentation, standards work, and automation so organizations can pivot as specifications and browser behavior evolve toward the 2029 migration target.

Read the original story

CloudflareEmerging ThreatsGoogle CloudPost-Quantum CryptographyQuantum ComputingCryptography MigrationMerkle Tree Certificates
Related Intelligence

Continue Reading

Expired contactless credit card on a worn wooden table with a blurred smartphone and NFC device in the background.

Researchers Expose Vulnerability in Expired Contactless Credit Cards

Expired contactless credit cards can be surprisingly revived, allowing scammers to make unauthorized transactions through a sneaky technique called man-in-the-middle tampering. Researchers have uncovered a vulnerability that lets attackers make expired cards appear valid, putting your financial security at risk.

Analyst 207
Smart home devices and a cat on a living room floor.

Comcast Activates WiFi Motion Detection in Home Security Push

Comcast is turning WiFi into a household motion detector, and it's surprisingly effective - detecting even slight movements like raising your hand or your cat's gentle stroll across the living room. By leveraging the radio links between your Xfinity Gateway and stationary devices, WiFi Motion converts them into virtual motion sensors that can detect movement around your home.

Analyst 207
Empty office setting with a laptop on a desk, screen facing away, surrounded by blurred office furniture and soft natural…

Microsoft Copilot Flaw Uncovered Through AI Model Manipulation

Researchers uncovered a concerning vulnerability in Microsoft Copilot, dubbed CoSnitch, which can be exploited with just one click to steal sensitive data without triggering obvious security alerts. The flaw was unusually revealed by Copilot itself during a normal interaction, highlighting the need for organizations to treat AI assistants with greater caution and scrutiny.

Analyst 207
Laptop on a desk with a blurred background and a suspicious link on paper.

Microsoft Copilot Flaws Expose One-Click Data Exfiltration Risk

Researchers uncovered a set of flaws in Microsoft Copilot, dubbed CoSnitch, that could allow attackers to exploit a user's session with just one click, potentially leading to data exfiltration. A single crafted link could trigger actions inside a signed-in user's assistant session, putting sensitive information at risk.

Analyst 207