Loading story…
The Cryptographic Community Specification Project (C2SP) published a specification for post-quantum algorithms for HTTP Message Signatures, extending the ecosystem around RFC 9421 as organizations prepare for cryptographic migration. The work builds on the existing HTTP Message Signatures standard, which defines how clients and servers sign HTTP request and response components such as @method, @path, @status, content-digest, and related fields to provide integrity and authenticity across web transactions.
The new specification appears alongside established Internet standards that underpin interoperable message signing and encoding, including RFC 4648 for Base16/Base32/Base64 encodings and the RFC convention language defined in BCP 14. Together, these references show the HTTP signing framework expanding from classical algorithms such as RSA, ECDSA, Ed25519, and HMAC toward post-quantum options, giving implementers a path to preserve signed HTTP exchanges against future quantum-era cryptographic threats.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
RFC 4648 was published in October 2006 to define Base16, Base32, Base32hex, Base64, and Base64url encodings and reduce ambiguity across Internet protocols. The document also obsoleted RFC 3548.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
c2sp.org
Open sourcerfc-editor.org
Open sourcerfc-editor.org
Open sourcerfc-editor.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cloudflare has added post-quantum authentication to **Authenticated Origin Pulls** and **Custom Origin Trust Store**, enabling customers to use **ML-DSA** signatures for Cloudflare-to-origin TLS and build fully post-quantum-secure mutual TLS on that link. The company said the protection is effective only if organizations also remove trust in classical authentication paths to avoid downgrade attacks, and positioned the release as a key step toward its stated goal of full post-quantum security by 2029. Cloudflare also noted that post-quantum authentication for browser-facing WebPKI traffic will follow a different approach based on **Merkle Tree Certificates**. The rollout comes amid broader industry acceleration toward quantum-safe security. Cloudflare Radar has been tracking worldwide post-quantum encryption adoption, while Microsoft said the timeline for quantum risk is shifting and urged faster migration planning. Cloudflare said the new capability required changes across its Go-based control plane and **Pingora Origin** data plane, and disclosed that a **BoringSSL** upgrade triggered a June 10, 2026 incident when stricter `KeyUsage` enforcement caused compatibility problems before the issue was patched and resolved.
Jul 29, 2026
Let's Encrypt said it will use **Merkle Tree Certificates (MTCs)** as its preferred approach for post-quantum authentication on the public web, arguing that conventional post-quantum signatures such as `ML-DSA` would make standard TLS certificate chains too large for reliable internet-scale handshakes. The model batches certificate issuance under a single signed Merkle tree head and delivers compact inclusion proofs, reducing handshake overhead while making Certificate Transparency inherent to issuance. Let’s Encrypt said current subscribers do not need to take immediate action, but future ACME clients and related tooling will need updates as the ecosystem moves toward the new format. The move aligns Let’s Encrypt with broader work by **Google, Cloudflare, Chrome, DigiCert, and the IETF**, as browser and infrastructure vendors push for scalable post-quantum TLS ahead of government migration deadlines from the NSA, NIST, and the EU. Let’s Encrypt plans a staging environment for MTC issuance in late 2026 and a production-ready deployment in 2027, while continuing to track `ML-DSA` support for traditional X.509 use cases outside the browser ecosystem. It also said the more urgent near-term defense remains post-quantum encryption against harvest-now-decrypt-later threats, urging operators to enable hybrid key exchange such as: ```text X25519MLKEM768 ```
Jun 29, 2026
Recent developments in post-quantum cryptography are addressing the growing threat posed by quantum computers to traditional digital signatures and encrypted communications. The National Institute of Standards and Technology (NIST) has approved new post-quantum digital signature algorithms, such as ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), to replace vulnerable mechanisms like RSA and elliptic curve signatures. These algorithms are designed to ensure the integrity and authenticity of digital documents and communications, even in the face of future quantum attacks. The focus on hybrid key exchanges, such as X25519MLKEM, is also gaining traction to mitigate "harvest now, decrypt later" (HNDL) threats, where adversaries collect encrypted data today to decrypt it once quantum capabilities become available. In parallel, industry innovation is bringing quantum-resistant technologies into operational environments. Forward Edge-AI has delivered its Isidore Quantum One-Way Data Diode to National Central University in Taiwan, marking a significant step in quantum-safe data protection for critical infrastructure. This device uniquely combines unidirectional data flow with NIST-approved post-quantum encryption (AES-256 GCM and ML-KEM), addressing the limitations of traditional data diodes that lack encryption and are vulnerable to HNDL attacks. The Isidore Quantum solution also offers deployment flexibility across both fiber and copper networks, reducing costs and accelerating adoption of quantum-safe communications.
Jun 29, 2026