Hello, The Apple Root Program has two post-quantum cryptography (PQC) policy changes underway impacting TLS Server Authentication and S/MIME. A new Apple Root Program policy is being established for Merkle Tree Certificates (MTCs), for Server Authentication only. An amendment will be made to the existing Apple Root Program Policy to accept traditional X.509 Root CA Certificates with composite algorithms, for Secure Email.
TLS Post-quantum certificate chains are roughly an order of magnitude larger than the classical chains they replace since TLS handshakes typically contain 5 signatures and 2 public keys. Experimentation with ML-DSA signatures in traditional X.509 hierarchies has shown to cause significant degradation of TLS handshakes in real-world deployments. Today, Certificate Transparency provides issuance transparency by embedding a certificate's TBSCertificate data as a leaf in a Merkle Tree, and having each log return a per-certificate signed promise of inclusion. With PQC, we can no longer afford this many per-certificate signatures to achieve the same properties. Merkle Tree Certificates address the PQC size concerns by replacing massive PQC signatures with a new compact signature scheme that also provides issuance transparency properties. In order for clients to validate these smaller certificates, they need to receive periodic out-of-band updates or fall back to larger PQC-based certificates. Apple Root Program expects to publish a draft MTC policy by the end of October 2026 at https://github.com/apple/apple-root-program. A survey for public feedback will follow the draft policy publication. The draft Apple Root Program MTC policy is expected to require: Three cosignatures for each certificate: an ML-DSA (minimum ML-DSA-44) cosignature from the issuing Operator an ECDSA (minimum ECDSA-P256-SHA256) cosignature from the issuing Operator an ML-DSA (minimum ML-DSA-44) cosignature from a different Operator acting as a mirror All cosigner keys in HSMs validated to FIPS 140-3 Level 3 or Common Criteria EAL 4+ Operators to register PENs with IANA to serve as the basis for Trust Anchor Identifiers Certificate validity capped at 7 days An annual audit Operators to publish far more non-private operational detail, including a record for every domain validation Apple Root Program expects to begin accepting applications from MTC CA Operators by late Summer 2027. Apple may establish a Test Phase for MTCs. If it does, we will share which subset of the draft policy requirements applies and how to participate. S/MIME S/MIME has a lower volume of certificate issuance and is less sensitive to latency than TLS, so the increased certificate size due to signing with PQC algorithms is less disruptive to the existing X.509 ecosystem. Apple will allow signing traditional X.509 certificates with composite algorithms made up of a combination of ML-DSA and ECDSA or RSA. The PQC part (ML-DSA) provides quantum secure security, and the classical part (ECDSA or RSA) keeps the system verifiable using an algorithm with decades of deployment experience and hardened implementations. Thank you, Apple Root Program [email protected] <mailto:[email protected]> -- You received this message because you are subscribed to the Google Groups "CCADB Public" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/ccadb.org/d/msgid/public/BC6E6F6C-8C5C-4D2A-A22D-0B6DAF8237C0%40apple.com.
smime.p7s
Description: S/MIME cryptographic signature
