Cloudflare 周二表示，计划签发抗量子 TLS 证书，从而成为首批签发此类证书的机构之一。这类证书采用一种被广泛认为能够抵御量子计算机攻击的加密技术。
Cloudflare said Tuesday it plans to issue quantum-proof TLS certificates, making it one of the first authorities to issue such certificates that use a form of cryptography that is widely believed to withstand attacks from quantum computers.
这家互联网基础设施提供商表示，将使用一个开源平台签发传统 TLS 证书，以及一种被称为 Merkle Tree Certificates（默克尔树证书）的后量子对应证书。这些混合证书将向付费和非付费用户免费提供。为帮助构建这一庞大系统，并使其在整个庞大的 TLS 生态系统中得到广泛采用，Cloudflare 将从 GlobalSign CA 收购一个已经获得信任的证书根。Cloudflare 表示，此举将使数百万个网站只需一键切换即可使用后量子证书，而且不会增加任何性能开销。
The Internet infrastructure provider said it will use an open source platform that issues both classic TLS certificates and a post-quantum equivalent known as Merkle Tree Certificates. The hybrid certificates will be free to both paying and non-paying users. To help build the massive system and establish ubiquity across the sprawling TLS ecosystem, Cloudflare will be acquiring an already trusted certificate root from CA GlobalSign. Cloudflare said the move will let millions of websites use post-quantum certificates at the flip of a switch and without incurring any increased performance overhead.
Cloudflare 的计划是全面改造网络公钥基础设施（WebPKI）的一部分，而这项改造对于确保网站加密和身份验证在后量子时代继续安全至关重要。一项重大挑战是使用易于在网络请求中传输、并可记录在透明度日志中的抗量子签名，以确保假冒证书不会被分配给网站。全面改造需要数年时间，因为操作系统、浏览器、证书颁发机构和互联网基础设施的设计都涉及数量众多的工程师。
Cloudflare’s plans are part of a major overhaul in the web public key infrastructure (WebPKI) required to make website encryption and authentication safe for the coming post-quantum age. A major challenge is using quantum-proof signatures that can be easily transmitted during web requests and recorded in transparency logs to ensure counterfeit certificates aren't assigned to websites. The makeover will take years to complete, because it requires the work of an untold number of engineers who design operating systems, browsers, certificate authorities, and Internet infrastructure.