IETF (Organization): news timeline & CVEs

Post-quantum website certificates from Cloudflare are scheduled for early 2027

Cloudflare will become a public certificate authority and plans post-quantum Merkle Tree Certificates in early 2027.

Cloudflare said it will become a public certificate authority, issuing conventional certificates and post-quantum Merkle Tree Certificates, with production MTC issuance planned for the first quarter of 2027. It agreed to acquire publicly trusted root key material from GlobalSign, expecting the deal to close within two months, so certificates work on older devices. Applications to the Chrome, Apple, Microsoft, and Mozilla root programs are pending, and classical issuance starts only after acceptance. MTCs, co-authored by Cloudflare as an IETF draft, use lightweight proofs so browsers can avoid sending heavy post-quantum signatures on every connection.

Help Net Security03:09 UTC · 5h agoIndustry 3 sources

Building a post-quantum certificate authority with Merkle Tree Certificates

Cloudflare becomes a certificate authority offering free Merkle Tree Certificate issuance, targeting Chrome's quantum-resistant root store inclusion in early 2027.

Cloudflare announced it is becoming a certificate authority that will support Merkle Tree Certificates (MTCs), an IETF PLANTS draft specification that batches certificates into an append-only Merkle tree signed at the root for compact post-quantum verification. The company targets early 2027 for inclusion in Chrome's newly launched Quantum-resistant Root Store, following a successful experimental deployment with Chrome, and will provide standard MTC issuance at no cost. Cloudflare notes post-quantum signatures are roughly 40 times larger than classical ones and would balloon certificate transparency log storage by 40x, motivating the MTC approach for authenticating roughly a billion TLS servers. Cloudflare also operates the Nimbus CT log family and is launching Raio, a new family of static CT logs.

Cloudflare Blogupdated 03:09 UTC · 5h agofirst Sep 29, 13:00 UTC · 19h agoTools 3 sources

Preventing quantum downgrade attacks against IPsec

Cloudflare and the IETF added IPsec downgrade protection after researchers found a design flaw letting quantum attackers decrypt PQ-capable tunnel traffic.

Cloudflare rediscovered a design flaw in IPsec that lets an on-path attacker with a quantum computer downgrade and decrypt all traffic between post-quantum-capable endpoints regardless of the authentication method used. The attack requires real-time quantum computation during the handshake rather than offline harvest-now-decrypt-later, and is not currently feasible, but shrinking quantum resource estimates pushed Cloudflare's migration deadline up to 2029. Cloudflare worked with the IETF on a downgrade protection extension and has rolled out beta support in Cloudflare WAN and Magic Transit, enabled via the ipsec_downgrade_protection account flag; both endpoints must support the extension for it to work.

Cloudflare BlogSep 29, 13:00 UTC · 19h agoVulnerability

HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)

RFC 10008 standardizes the HTTP QUERY method, creating potential WAF inspection bypasses, cache poisoning, and CSRF gaps because most defenses don't recognize the new verb.

The IETF published RFC 10008 in June 2026 defining HTTP QUERY, the first new standard method since PATCH in 2010, behaving as a safe, idempotent, explicitly cacheable GET whose query lives in the request body. SANS handler Xavier Mertens warns that WAF rules, API-gateway allowlists, CSRF middleware, and caches built around the classic verb set may not inspect QUERY bodies, allowing SQL injection or XSS payloads to bypass inspection where POST would be blocked. Behavior in the wild is inconsistent: nginx's limit_except silently rejects QUERY and never caches it, while curl, Caddy, Traefik, FastAPI explicit routes, and .NET 10 pass or support it, and Cloudflare/Akamai co-authored the RFC. The author found no QUERY requests in his logs yet and recommends updating method-matching rules and allowlists to include QUERY.

SANS Internet Storm CenterSep 18, 06:05 UTC · 12d agoResearch

IETF

Timeline4 articles

Appears with

Post-quantum website certificates from Cloudflare are scheduled for early 2027

Building a post-quantum certificate authority with Merkle Tree Certificates

Preventing quantum downgrade attacks against IPsec

HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)