Merkle Tree Certificates#

David Benjamin (Google), Devon O'Brien (Apple), Bas Westerbaan, Luke Valenta (Cloudflare), Filippo Valsorda (Geomys).

• Why: The PKI arithmetic problem: post-quantum signatures are huge (ML-DSA-44: 2,420 bytes/sig; ML-DSA-65: 3,309) and certificate lifetimes are shrinking — two SCTs plus a leaf signature adds ~7,260–9,927 bytes of authentication overhead, and CT log storage scales with entry size and issuance rate. MTCs redesign the certificate to survive both trends.
• What: A new X.509-adjacent certificate form where the CA certifies by logging: it appends TBSCertificate entries to append-only issuance logs, signs checkpoints and subtrees, and independent cosigners attest correct (optionally mirrored) operation. A certificate is the tbscert + a Merkle inclusion proof + cosignatures — log entries contain hashes instead of public keys and no signatures, so they don't scale with PQ key/sig size. An optional "landmark-relative" certificate eliminates signatures entirely for up-to-date relying parties, and "revoked ranges" let RPs bulk-discard long-expired log entries so monitoring infrastructure scales by retention policy, not log lifetime.
• How: Uses a "subtree" Merkle primitive (inclusion and consistency proofs) so proofs stay small; ACME extensions (Section 9, the part presented in Vienna) define issuance; TLS use covers both standalone and landmark-relative forms.
• Where applicable: Public web PKI first, but the mechanism is general. This is a WG document (PLANTS) now at -07 — the most mature PKI redesign on the IETF's table, with the browser/CDN ecosystem already at the table.