Cloudflare Now Supports Post-Quantum Authentication
ML-DSA signatures enable quantum-resistant secure connections.
1Major Milestone in Post-Quantum Security
Cloudflare announced support for post-quantum authentication to protect against future quantum computer threats. This step provides an effective defense mechanism against 'harvest now, decrypt later' attacks. The first phase of their roadmap toward full post-quantum security by 2029 is now complete. ML-DSA signatures secure connections between Cloudflare and customer origin servers.
2Cloudflare's Quantum Roadmap
The company set a goal for full post-quantum security by 2029 with several milestones along the way. The first major achievement is enabling ML-DSA support in Authenticated Origin Pulls and Custom Origin Trust Store products. This development allows quantum-resistant certificate protection for connections between Cloudflare and customer servers. Targets NIST Category 2 security level.
3Two-Layered Connection Security
For users visiting Cloudflare-proxied websites, two distinct connections exist: user-to-Cloudflare and Cloudflare-to-origin server. Both connections require protection against quantum attacks. Quantum-resistant encryption was enabled for user-side connections in 2022 and server-side in 2023. Now the authentication layer is being strengthened with post-quantum solutions.
4Advantages of ML-DSA Algorithm
Module-Lattice-Based Digital Signature Algorithm (ML-DSA) provides secure digital signatures in a post-quantum world. Cloudflare supports ML-DSA-44, ML-DSA-65, and ML-DSA-87 parameter sets. ML-DSA-44 is particularly recommended for its balance of performance and security. This algorithm eliminates the risk of traditional certificates being broken by quantum computers.
5Custom Trust Store Configuration
The Custom Origin Trust Store (COTS) product allows customers to use their own Certificate Authorities instead of Cloudflare's default trust store. Now supports uploading ML-DSA-based CAs. This feature, which requires Advanced Certificate Manager, provides enterprise customers with additional security flexibility. Ideal for servers running in SSL Full (strict) mode.
6Authenticated Origin Pulls
Authenticated Origin Pulls (AOP) enables Cloudflare servers to authenticate to customer origin servers. This free feature available on all plans establishes mutual TLS (mTLS) connections. AOP offers three configuration levels to prevent abuse and limit resource consumption. Can be configured globally, per zone, or per hostname.
7Solutions Independent of WebPKI
Cloudflare can operate independently of public internet certificate constraints. Preexisting trust relationships with customer accounts enable use of custom PKIs without intermediate certificates or Certificate Transparency overhead. Solutions like Cloudflare Tunnel provide post-quantum security without upgrading legacy systems.
8Merkle Tree Certificates Coming
For user-to-Cloudflare connections, work continues on Merkle Tree Certificates (MTC) being developed at IETF. Developed in collaboration with Google, these certificates aim for 2027 deployment. MTCs will provide fast, quantum-resistant certificates for the web. Cloudflare plans to integrate this technology for origin connections too.
9Connection Pooling Advantage
Cloudflare uses connection pooling techniques for origin connections. All network requests are funneled to a smaller set of origin connections. This approach amortizes connection setup costs across many requests. Keeps performance impact of post-quantum signatures manageable. Reduces need for MTC's performance benefits.
10FIPS 204 Compliance
Cloudflare's ML-DSA implementation supports all FIPS 204 parameter sets. This standard set by NIST is critical for post-quantum security. While ML-DSA-44 provides NIST Category 2 security, higher parameters offer additional protection. Provides flexible options for enterprise customers with varying security needs.
11Industry-Wide Developments
Recent breakthroughs in quantum computing and cryptanalysis have spurred action across industry and government. Many companies and agencies are working to prepare infrastructure for a post-quantum world. Cloudflare's move sets an example for other players. Similar solutions are rapidly gaining traction in finance and defense sectors.
12Critical for Digital Infrastructure
In a future where quantum computers could break traditional encryption, internet security faces significant risks. Cloudflare's initiative is vital for maintaining digital infrastructure continuity. Organizations handling sensitive data need to adopt post-quantum solutions urgently. This transition will shape internet security for decades to come.