Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces the concept of context closure in post-quantum authentication for WebPKI, addressing the limitations of traditional certificate authentication in preserving mutable authorization contexts. The authors present \LRp, a two-plane construction that effectively authenticates mutable CA-context state while minimizing the data overhead associated with dependency references. Their implementation shows significant reductions in the size of warm path data compared to conventional stateless bundles, demonstrating a practical solution for maintaining security in a post-quantum landscape.
Context closure could revolutionize WebPKI by ensuring that mutable authorization contexts are securely authenticated without the heavy data costs of traditional methods.
Post-quantum migration increases WebPKI authentication cost, but authenticating a compressed certificate object does not by itself preserve the mutable authorization context under which a relying party accepts it. We formalize \emph{context closure}: the authenticated projection accepted by a verifier must determine the selected authorization semantics it claims, relative to declared source contracts and event-coverage witnesses. We instantiate this idea with \LRp, a two-plane post-quantum construction that authenticates mutable CA-context state in an update plane while the warm path carries only state-local dependency references selected by explicit profile negotiation. In a pinned CCADB reconstruction, we obtain 44,912 path/view contexts and 16,858 physical CA lineages across Apple, Chrome, Microsoft, and Mozilla views. The core compiler yields $m_{50}=6$, $m_{95}=16$, and $m_{\max}=18$ typed dependencies. A warm LR+ selector therefore costs 296, 776, and 872 bytes at median, p95, and maximum, compared with 3,842, 5,932, and 6,350 bytes for a one-signature stateless bundle carrying the same dependency vector. The retained all-view closure state is 16.15 MB, and per-view lifecycle crossovers range from 19.60 to 50.41 median-path warm authentications/day under the stated checkpoint and update model. The implementation and evaluation artifact are available at https://github.com/nserser/LR-WebPKI