A Post-Quantum Future for Let's Encrypt
Let’s Encrypt’s plans to adopt post‑quantum signatures and Merkle Tree Certificates (MTCs) are prompting a broader re‑evaluation of how the web should prepare for quantum attacks on cryptography. Commenters weigh the trade‑offs between hybrid key encapsulation, new lattice‑based algorithms, and current RSA/ECC schemes, debating both practical risks like “harvest‑now, decrypt‑later” and long, messy migration timelines for certificates, firmware, and infrastructure. While there is no consensus on how imminent cryptographically relevant quantum computers are, there is growing agreement that transitioning authentication and key exchange to post‑quantum-safe mechanisms must start well before any clear quantum breakthrough.
Post-quantum threat model and capabilities
- Several comments note that quantum capabilities are well-modeled theoretically (complexity classes like BQP, Shor’s and Grover-style speedups), even if practical machines don’t exist yet.
- Security of both classical and PQ schemes is still heuristic: no one can prove their hardness, but many years of failed attacks provide confidence.
- Some argue “store now, decrypt later” makes encryption migration urgent; others stress that signatures and long‑lived keys are at least as urgent because quantum forgeries would be indistinguishable from classical compromises.
Hybrid crypto, KEMs, and “encrypt twice”
- Strong pushback against the naïve idea of “just encrypt data twice with two schemes.”
- Recommended pattern: hybrid key encapsulation (multiple KEMs, e.g., classical + PQ, whose shared secrets are securely combined, then a single symmetric AEAD is used).
- Repeated emphasis that KEMs are not “just encryption of keys” and that precise terminology matters to avoid insecure constructions.
- For KEMs, hybrids are widely seen as reasonable; for signatures, hybrids are more controversial because they can weaken some desirable security properties.
Algorithm choices and lattice confidence
- Discussion centers on lattice-based schemes (ML-KEM, ML-DSA) as current PQ standards, with parameter “security levels” benchmarked against AES and hash strengths.
- LWE and related lattice problems are described as among the best‑understood hardness assumptions in public‑key crypto, arguably better understood than RSA in some respects.
- Past PQ failures like SIKE/SIDH are used as cautionary tales but not seen as undermining lattices as a whole.
Merkle Tree Certificates (MTCs) and transparency
- MTCs promise smaller handshakes (in the common case) and built‑in transparency: every certificate must be in a Merkle tree.
- Main downsides raised:
- Clients need continuous out‑of‑band syncing of “landmarks”; offline or flaky environments may fall back to very large PQ signatures.
- TLS servers and clients become more complex; non‑browser tooling and embedded systems may lag or avoid landmark‑relative certs.
- MTCs aim to fix weaknesses in today’s Certificate Transparency (SCTs, multi‑log complexity); verifiable indexes are mentioned as a future improvement for monitoring.
Trust, backdoors, and skepticism
- Some commenters distrust NSA/EU involvement and see no immediate quantum threat, advocating to keep RSA/Ed25519.
- Others counter that there is no concrete candidate backdoor in standardized PQ schemes and that multiple jurisdictions (including non‑US) are converging on similar lattice‑based designs.