Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Merkle Tree Certificate Post-Quantum PKI for Kubernetes and Cloud-Native 5G/B5G Core

Lakshya Chopra, Vipin Kumar Rathi

Abstract

Post-quantum signature schemes such as ML-DSA-65 produce signatures of 3,309 bytes and public keys of 1,952 bytes over 50 times larger than classical Ed25519. In TLS-authenticated environments like Kubernetes control planes and 5G Core networks, where every inter-component connection is mutually authenticated, this overhead compounds across thousands of handshakes per second. Merkle Tree Certificates (MTC), currently under development at IETF, replace per-certificate issuer signatures with Merkle inclusion proofs and, in the landmark mode, eliminate on-wire signatures from certificate authentication entirely. We present MTC-based PKI architectures for Kubernetes and 3GPP 5G Service-Based Architecture. Starting from the infrastructure layer, we replace the Kubernetes cluster CA with an MTCA deployment that issues MTC certificates to control plane components, with cosigners and a DaemonSet-based landmark distributor. Building on this, we design a certificate lifecycle for 5G Network Functions deployed against QORE, a post-quantum 5G Core. We implement MTC proof construction and verification in Go crypto/tls and crypto/x509 packages. Our measurements on an Intel i9-12900 show MTC landmark verification completing in under 2 μs compared to 24 microseconds for ECDSA signature verification-with no measurable impact on TLS handshake time. We further propose a 6G-native architecture where the NRF serves as the MTCA and the SCP as witness cosigner, and discuss applicability to Non-Terrestrial Networks.

Merkle Tree Certificate Post-Quantum PKI for Kubernetes and Cloud-Native 5G/B5G Core

Abstract

Post-quantum signature schemes such as ML-DSA-65 produce signatures of 3,309 bytes and public keys of 1,952 bytes over 50 times larger than classical Ed25519. In TLS-authenticated environments like Kubernetes control planes and 5G Core networks, where every inter-component connection is mutually authenticated, this overhead compounds across thousands of handshakes per second. Merkle Tree Certificates (MTC), currently under development at IETF, replace per-certificate issuer signatures with Merkle inclusion proofs and, in the landmark mode, eliminate on-wire signatures from certificate authentication entirely. We present MTC-based PKI architectures for Kubernetes and 3GPP 5G Service-Based Architecture. Starting from the infrastructure layer, we replace the Kubernetes cluster CA with an MTCA deployment that issues MTC certificates to control plane components, with cosigners and a DaemonSet-based landmark distributor. Building on this, we design a certificate lifecycle for 5G Network Functions deployed against QORE, a post-quantum 5G Core. We implement MTC proof construction and verification in Go crypto/tls and crypto/x509 packages. Our measurements on an Intel i9-12900 show MTC landmark verification completing in under 2 μs compared to 24 microseconds for ECDSA signature verification-with no measurable impact on TLS handshake time. We further propose a 6G-native architecture where the NRF serves as the MTCA and the SCP as witness cosigner, and discuss applicability to Non-Terrestrial Networks.

Paper Structure

This paper contains 88 sections, 4 equations, 7 figures, 22 tables.

Table of Contents

  1. Introduction
  2. Motivation
  3. Challenges of Post-Quantum Signature Schemes
  4. Impact on Telecom.
  5. Impact of Post-Quantum Signatures on 5G Core Service Based Architecture
  6. Alignment with Zero-Trust Requirements in 5G Networks
  7. Background
  8. Public Key Infrastructure
  9. TLS 1.3
  10. Post-Quantum Cryptographic Transition
  11. Certificate Transparency
  12. Merkle Tree Certificates
  13. Related Work
  14. 5G Core Network
  15. Cloud Native 5G Core
  16. ...and 73 more sections

Figures (7)

  • Figure 1: Kubelet client certificate bootstrap and rotation via the CSR API.
  • Figure 2: End-to-end MTC certificate lifecycle in Kubernetes.
  • Figure 3: MTC certificate issuance for a 5G NF. Provisioning and issuance produce a standalone certificate at startup. The landmark certificate is pulled after the next landmark allocation.
  • Figure 4: Landmark update propagation. The distributor DaemonSet verifies subtree hashes via the mirror and writes them locally. NFs pull their landmark certificate from the MTCA.
  • Figure 5: MTC-based PQ-TLS 1.3 handshake between 5G NFs. Certificate authentication is hash-only via MTC landmark verification. The sole PQ signature on the wire is CertificateVerify (ML-DSA-65, 3,309 B).
  • ...and 2 more figures

Theorems & Definitions (2)

  • Definition 1: MTC Certificate
  • Definition 2: Landmark Certificate