PostQuantum Cryptography - PQC

PostQuantum Era is coming!

The Race Against the Quantum Clock

The tech world isn’t waiting around for a "Quantum Apocalypse." Industry giants like Google, Cloudflare, and other major infrastructure providers are already deep in the trenches, hardening their systems against the looming security risks of quantum computing.

The consensus among cybersecurity experts is clear: current encryption standards have an expiration date. According to various industry roadmaps and government advisories, existing digital certificates will likely become obsolete in the near future. To stay ahead of the curve, a full-scale migration to Post-Quantum Cryptography (PQC) will be required—with many experts targeting 2030 as the critical deadline for a complete transition.

Here are some links with additional explanations.

CloudFare migrating security to PostQuantum era

Why 2030 Matters for Post-Quantum Cryptography

Google Shortens Timeline for Quantum-Safe Encryption Transition

How transition will work?

We won’t dive into the complex details of quantum cryptography here—that has been covered extensively elsewhere. Instead, we’ll provide a high-level, technically light overview of how the transition will actually work and what it means for the future of security.

The backbone of modern security relies on digital certificates—usually powered by RSA or Elliptic Curve (EC) keys. In the world of Post-Quantum Cryptography (PQC), these are being replaced by new standards like ML-KEM (for key encapsulation) and ML-DSA (for digital signatures).

Just like their predecessors, these new algorithms can be used to issue certificates. However, there’s a catch: for software to actually use them, it needs to support both the new algorithms and a revamped certificate structure. To bridge the gap between "today" and "tomorrow," the industry is looking at three primary transition formats:

The Three Paths of Transition

To make the shift as painless as possible, three distinct certificate formats have emerged:

  1. Composite Certificates (The "Double Lock")This method combines two keys—one PQC (like ML-KEM) and one traditional (RSA or EC)—into a single, unified key structure. To be valid, both "locks" must be verified.
  2. Chameleon / Delta Certificates (The "Hidden Extra")This looks like a standard RSA or EC certificate to older systems. However, it contains a special extra attribute—the AlternatePubKey—where the ML-KEM public key is tucked away for quantum-ready systems to find.
  3. Pure PQC / Isolated (The "Quantum Native")This is a clean break from the past. It is a standard certificate containing only the new PQC public key, stored under a new Object Identifier (OID).

The Challenge: Compatibility Complexity

While Pure PQC and Traditional certificates are straightforward (they only have one key type), the other two formats introduce a layer of complexity.

Because Composite and Chameleon certificates carry two types of keys, they require extra processing power and verification steps on both the client and server sides. This creates a matrix of compatibility: how does a modern server talk to a legacy browser? Or a quantum-ready app talk to an older database?

The transition isn't just about stronger math; it's about managing this "hybrid" period where different systems must learn to speak two cryptographic languages at once.

Here is a table of certificate types combinations and their compatibility

Scenario Root CA Intermediate CA Server / Client Compatibility (Clients) Notes
1. Traditional Classic (RSA/ECC) Classic Classic All clients No PQC protection. Vulnerable to quantum computers.
2. Full Chameleon Chameleon (Delta) Chameleon (Delta) Chameleon (Delta) All clients (classic and PQC) Highest compatibility; client "chooses" which part of the certificate it sees. Complex to implement.
3. Full Composite Composite Composite Composite Only new PQC clients Most secure (dual signature). Legacy clients will reject the certificate as they don't recognize the format.
4. Hybrid Transitional Chameleon Composite Composite Mixed Root acts as a "bridge," while lower-level certificates are modern hybrids.
5. Isolated PQC Pure PQC (e.g., ML-DSA) Pure PQC Pure PQC Only PQC clients Used in closed, high-security systems.
6. "PQC on Top" Classic Composite Composite All clients Common model: Root remains legacy, while the Intermediate adds a PQC layer for modern communication.

General browser support

While certain technical specifications for PQC are still in the draft phase, the transition is already well underway. Major browsers have already begun implementing internal support for quantum-resistant certificates to stay ahead of the curve.

The next major milestone will be the finalization of the Web Crypto API V2, which will bring native PQC support to JavaScript. Once that draft is complete and implemented, developers will be able to handle quantum-resistant logic directly within the browser's native environment.

Until then, here is a snapshot of the current browser landscape:

Scenario Chrome & Edge (Chromium) Firefox
1. Traditional Full support. This is the current standard. Full support.
2. Full Chameleon Partial. They only see the "classic" part. PQC (Delta) extensions are ignored. Partial. Behaves like Chromium; ignores PQC additions.
3. Full Composite No support. Will report an error because the combined algorithm OID is not recognized. No support. Firefox's NSS module does not yet support Composite OIDs.
4. Hybrid (Recommended) Best transitional option. The browser uses the classic RSA/ECC part for the TLS handshake. Best transitional option. Works stably as long as a classic fallback exists.
5. Isolated PQC Experimental. Supported only in specific "dev" versions with flags enabled. Under development. Currently not intended for production.
Browser PQC Support Status Notes
Google Chrome Active Supports hybrid KEM (X25519Kyber768) by default.
Mozilla Firefox Experimental Support can be enabled via about:config flags.
Microsoft Edge Active Follows Chromium implementation for hybrid exchanges.
Safari / WebKit In Development Tracking industry standards; limited public implementation.

Scenarios for browser full support

Based on all said about certificate types, browsers support for such certificate combination and how they handle each of them is different.

Scenario Root CA Intermediate Server Cert Browser Support (Chrome/Edge/Firefox)
1. Pure Classic RSA / ECC RSA / ECC RSA / ECC FULL. Today's standard.
2. Chameleon Bridge Chameleon Classic Classic FULL. Browser only sees the classic part of the Root, ignores PQC extensions.
3. Hybrid Path Chameleon Chameleon Chameleon FULL. Browser sees the classic key at every step and ignores PQC "Delta" additions.
4. Composite Break Chameleon Composite Composite ERROR. Browsers do not recognize the Composite OID and don't know how to "extract" the classic key from it.
5. Experimental Classic Classic Chameleon ERROR. Browser uses RSA for TLS, while your application uses PQC from the extension.
6. Pure PQC ML-DSA ML-DSA ML-DSA ERROR. Browsers return ERR_CERT_INVALID because they do not recognize PQC signature algorithms.

The Path Forward: Why Chameleon Certificates Lead the Way

Looking at the current landscape, the Chameleon (Delta) certificate emerges as the clear winner for a smooth transition. It offers the perfect "best of both worlds" scenario: a standard certificate structure that includes a hidden PQC attribute.

This approach ensures maximum compatibility:

  • Legacy-Friendly: If a client or server doesn't recognize PQC yet, they simply ignore the extra attribute and process the connection as a standard RSA or EC certificate. Nothing breaks.
  • Quantum-Ready: Systems that are PQC-enabled will detect the attribute and immediately upgrade to a quantum-resistant connection.
  • Future-Proof: As PQC technology matures, these certificates will continue to work seamlessly, eventually shifting the "heavy lifting" to the PQC keys entirely.

While the ultimate goal is to reach Pure PQC environments, the Chameleon approach provides the safety net we need today. It allows us to build the infrastructure of tomorrow without pulling the plug on the systems of today.