Merkle Tree Certificates Proposed to Enable Lightweight Post-Quantum HTTPS in Chrome
Google Chrome developers, working with colleagues from other companies and experts from the IETF PLANTS working group, are preparing the first HTTPS change aimed at solving performance problems expected from post-quantum cryptography. The solution is Merkle Tree Certificates (MTC), compact TLS certificates built on Merkle trees that replace heavy signature chains with lightweight inclusion proofs.
Why post-quantum cryptography needs smaller certificates
Post-quantum cryptographic algorithms typically produce larger keys and signatures than classical schemes, increasing both network traffic and computational load during TLS handshakes. Merkle Tree Certificates address this by having a certificate authority sign only the root of a Merkle tree; each individual MTC then serves as a compact proof that a particular certificate is included in that tree.
In the new model, the amount of authentication data sent to the browser shrinks dramatically compared with conventional X.509 chains, allowing strong post-quantum algorithms to be deployed without slowing down web connections. An additional security benefit is built-in transparency: because every certificate must be recorded in the public Merkle tree, the properties of today’s Certificate Transparency ecosystem become mandatory by default.
How Merkle Tree Certificates work
A Merkle tree is constructed by hashing individual records and then repeatedly hashing pairs of hashes until a single root hash remains. To prove that a specific record belongs to the tree, only the hashes along the path from the record to the root are required. The scheme has been extended to support trees of arbitrary size (not just powers of two) and to allow efficient proofs that one log is a prefix of another.
These properties make MTC suitable for real-world certificate issuance at internet scale while maintaining the auditability required by modern public-key infrastructure.
Chrome deployment timeline
Performance testing of TLS connections using MTC is already being conducted in collaboration with Cloudflare. After validation of the core technology in early 2027, operators of existing Certificate Transparency logs that are trusted by Chrome will be invited to run the first public MTC logs. By the third quarter of 2027, requirements for additional certificate authorities to join a dedicated post-quantum Chrome Root Store supporting only MTC are expected to be finalized. This new root store will operate alongside the current Chrome Root Store.
The field is evolving rapidly, and the outlined schedule may be adjusted as implementation experience grows.
Related articles
AI Resume Screening Barriers Push Young IT Talent Toward Cybercrime
Young Russian IT graduates with relevant projects and freelance experience are struggling to secure entry-level roles in information security and antifraud due to automated resume filters demanding prior commercial experience. Data from SuperJob and Habr Careers shows only 10-11% of IT vacancies in early 2026 were open to candidates without experience, compared to 37-38% across the broader labor market, with most junior openings limited to technical support. Russian court statistics reveal that 67.9% of those convicted for computer-related crimes under Article 272 were under 30, aligning with the age when graduates first seek professional experience. International studies, including research from Harvard Business School and Accenture, highlight how overly rigid automated screening discards capable candidates lacking formal tenure. Programs like the UK's National Crime Agency Cyber Choices demonstrate that providing legal pathways in cybersecurity can reduce recidivism. The article argues that excessive reliance on AI filters without human review of projects or practical tests exacerbates the pipeline problem in a sector claiming talent shortages.
Bill Gates Calls for Stronger External Oversight and Regulation of AI
Bill Gates stated in an NBC News interview that self-regulation by AI developers is no longer sufficient and urged Congress to pass binding laws on artificial intelligence. He warned that AI tools in the hands of malicious actors could trigger catastrophic events capable of causing up to a billion deaths, emphasizing the unprecedented power of combining bad intentions with modern AI systems. Gates advocated for mandatory rules, audits, and monitoring, particularly in critical sectors such as medicine, finance, and government infrastructure, while acknowledging that some added bureaucracy would be necessary. Leaders from Anthropic and OpenAI have similarly suggested slowing AI development, with former Anthropic employee Jacob Coxon publicly accusing companies of playing roulette with lives by pursuing self-improving superintelligence. House Speaker Mike Johnson prefers to wait for industry proposals, whereas Mark Zuckerberg opposes coordinated oversight and believes individual labs should decide on pace. Several U.S. states including California, Maryland, and New York have already begun launching their own AI regulatory initiatives and expert panels.
Implementing DevSecOps in Unprepared Teams: A Practical Three-Month Roadmap
Many development teams face resistance when security tools are introduced without proper process changes, leading to bypassed checks and unresolved findings. The article outlines a structured approach for small teams of five to eight developers without a dedicated security specialist, focusing on one service as a pilot. It emphasizes assigning clear roles including a Security Champion, selecting initial checks such as secret scanning with Gitleaks and dependency analysis, and converting scanner reports into actionable tasks with owners and deadlines. The plan covers the first eight weeks of setup, including baseline handling for legacy issues, automated blocking rules, and incident rehearsal exercises. Metrics recommended include time to first triage, age of open critical defects, and false positive rates, aligned with DORA indicators for release performance. The guidance draws on OWASP SAMM practices and stresses that security requirements must be integrated into daily workflows rather than added as extra gates.
Why Technically Strong CISOs Lose to Weaker Peers: The Hidden Role of Internal Politics
A new analysis from independent expert Andrey Biryukov explains why technically proficient CISOs frequently fail to secure budgets and executive support while less technical peers succeed. The core issue lies not in technical knowledge but in the ability to translate security risks into business language that resonates with CFOs, CEOs, and boards. Biryukov details how influence, rather than formal authority, determines whether security initiatives gain traction or stall in endless approvals. He emphasizes building coalitions in advance, crafting compelling narratives, and preparing concrete business cases that quantify revenue impact and regulatory exposure. The article also highlights common pitfalls such as relying on fear-based arguments or ignoring stakeholder KPIs. Ultimately, the piece argues that selling security internally is essential for any CISO who wants both resources and long-term survival in the role.