Cloudflare has announced support for post-quantum (PQ) authentication when connecting to customer origin servers. This feature is available via two existing mechanisms: Authenticated Origin Pulls and Custom Origin Trust Store. It represents the first step in a broader effort to integrate PQ authentication across all Cloudflare products.
- Authenticated Origin Pulls now support PQ authentication using the X25519MLKEM768 key exchange mechanism. This allows Cloudflare to verify its identity to origin servers using post-quantum cryptographic keys, ensuring that even a future quantum computer cannot forge Cloudflare's identity.
- Custom Origin Trust Store also gains PQ support, enabling customers to upload their own post-quantum certificates for origin authentication. These certificates can be generated with ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism) or other PQ algorithms.
- The implementation uses hybrid key exchange (X25519 with ML-KEM768) to provide security against both classical and quantum threats. This ensures backward compatibility during the transition period.
- No new API endpoints or configuration flags were introduced; existing endpoints like
POST /zones/:zone_id/origin_tls_client_authandPOST /accounts/:account_id/acm/total_tls/settingsnow automatically negotiate PQ authentication when the origin server supports it. - Cloudflare's edge network has been updated to prefer PQ key exchange for these connections, but falls back to classical cryptography if the origin does not support PQ.
For developers, this update is crucial for future-proofing origin security. As quantum computing advances, today's classical authentication methods could become vulnerable. By enabling PQ authentication now, developers protect their infrastructure against "harvest now, decrypt later" attacks, where encrypted traffic is collected today for future decryption. The hybrid approach ensures seamless interoperability while gradually migrating to post-quantum standards. To get started, origin servers must be configured to accept PQ certificates, and customers should generate new certificates using PQ-compatible algorithms. Cloudflare plans to extend PQ authentication to other products like API Gateway and Workers later this year.
Source: https://blog.cloudflare.com/post-quantum-authentication-to-origins/