Advisories
Chrome Launches Merkle Tree Certificate Initiative to Enable Quantum‑Safe HTTPS
Google’s Chrome team has announced a new effort to adopt Merkle Tree Certificates (MTCs) for quantum‑resistant TLS. The initiative, driven by the IETF PLANTS working group, replaces bulky X.509 chains with compact proofs, allowing post‑quantum algorithms without bandwidth penalties. Defenders should monitor MTC deployment and update CT logs accordingly.
What Happened
Google Chrome announced a new program to support quantum‑safe HTTPS by adopting Merkle Tree Certificates (MTCs). The move is coordinated with the IETF’s PLANTS working group, which addresses performance and bandwidth issues of post‑quantum cryptography in TLS.
Impact
Defenders who rely on Chrome for client connectivity will see a shift from traditional X.509 certificates to MTCs once the feature is enabled. The change does not affect existing root certificates; Chrome will not add post‑quantum X.509 to its root store immediately.
Technical Overview
- CA signs a single “Tree Head” that represents millions of certificates.
- The browser receives a lightweight inclusion proof instead of a full signature chain.
- MTCs keep the authentication data minimal while allowing robust post‑quantum algorithms.
What to Do
Monitor Chrome’s rollout status and test MTC support in your environment. Update your Certificate Transparency logs to accept MTC proofs and verify that your CA infrastructure can generate and publish tree heads. Ensure that your monitoring tools can parse the new proof format.
Future Considerations
When MTCs become widely deployed, evaluate the impact on TLS handshake timings and bandwidth usage. Keep an eye on IETF PLANTS drafts for any changes to the proof format or required CT extensions.
Related articles
Post‑Quantum Authentication: Immediate Steps for SecOps and PKI Teams
Microsoft’s Post‑Quantum Cryptography (PQC) TLS Pilot Program invites certificate authorities to test new algorithms in a controlled environment. Security teams should inventory certificate dependencies, review vendor roadmaps, and set up non‑production test beds to surface interoperability gaps before PQC becomes mandatory.
Read briefing
Elastic Launches Bounty Program for SIEM/EDR Rule Validation
Elastic has expanded its public bounty program to invite researchers to test and improve its SIEM and EDR detection rules on Windows endpoints. The initiative targets security teams using Elastic Security, encouraging them to review rule efficacy and report gaps. Defenders should monitor the HackerOne portal, review rule documentation, and incorporate findings into their detection strategy.
Read briefing
Unauthorized HTTPS Certificates Issued for Google Domains via Hijacked .gh, .sl, .as Registries
Attackers compromised the .gh, .sl, and .as ccTLD registries, obtaining 12 unauthorized domain‑validated certificates for Google and YouTube domains. Google’s own systems were untouched, but the certificates could allow attackers to impersonate Google sites over TLS. Defenders should verify DNS integrity, monitor Certificate Transparency logs, and ensure revoked certificates are propagated via CRL sets.
Read briefing
CrowdStrike Launches Falcon Guardian: AI‑Driven Runtime Protection for Endpoints
CrowdStrike has unveiled Falcon Guardian, a new AI detection and response platform that protects AI agents at runtime, introduces an AI gateway, and expands expert‑led defense capabilities. The solution is designed for SecOps teams to detect and contain AI‑based threats across endpoints and cloud workloads. Defenders should integrate Falcon Guardian with existing XDR, enable the AI gateway, and monitor for anomalous AI activity.
Read briefing