Cloudflare shifts post‑quantum plans
Cloudflare says it is actively adjusting its post‑quantum cryptography priorities after a Google warning accelerated timelines, signalling major internet infrastructure players are revising roadmaps now. For systems that store long‑lived mortgage records and integrate many partners, cryptographic agility is a real dependency-mapping and rollout challenge. (csoonline.com) (cybersecurity-insiders.com)
Most internet security still relies on math that a powerful quantum computer could eventually crack, the way a bolt cutter beats a padlock that looked solid for years. Cloudflare said on April 7 that it is now pulling its deadline forward and wants its whole platform to be post-quantum secure by 2029. (blog.cloudflare.com) The basic fix is called post-quantum cryptography, which means swapping in new math before the old math fails. The United States National Institute of Standards and Technology published its first standards in August 2024, including Module-Lattice-Based Key-Encapsulation Mechanism, or ML-KEM, for setting up shared secret keys. (csrc.nist.gov) A shared secret key is the temporary code two computers agree on before they start talking privately, like two people choosing a private radio channel before a conversation. ML-KEM is designed so that even an attacker with a quantum computer is not expected to recover that shared secret from the public exchange. (csrc.nist.gov) Cloudflare has been working on the traffic part of this for years. It says it began preparing in 2019, turned on post-quantum encryption for all websites and application programming interfaces on its network in 2022, and now sees more than 65% of human traffic to Cloudflare using post-quantum encryption. (blog.cloudflare.com) That jump happened because the browser side finally started showing up. Cloudflare’s own compatibility page says the newer hybrid key exchange is now on by default in Chrome 131 and later, Firefox 132 and later on desktop, Edge 131 and later, and Safari 26 and later. (developers.cloudflare.com) The harder part is not the traffic tunnel. The harder part is authentication, which is the proof that a server, employee, software update, or partner system is really who it claims to be, and Cloudflare said that piece is now the crucial priority. (blog.cloudflare.com) Google helped force that shift. On March 25, Google said it was setting its own post-quantum migration timeline to 2029 and explicitly told engineering teams to prioritize authentication services because digital signatures have to be replaced before a cryptographically relevant quantum computer arrives. (blog.google) Then Google Research added more pressure on March 31. It said its new whitepaper had updated estimates for the quantum resources needed to break the 256-bit elliptic curve problem that protects elliptic curve cryptography, which is used across the modern internet. (research.google) Cloudflare’s April 7 post says that warning changed its urgency because elliptic curve cryptography is everywhere, from website certificates to login keys. Cloudflare also wrote that Google had “drastically improved” the algorithm for breaking elliptic curve cryptography and that this, along with other new estimates, compressed the migration timeline. (blog.cloudflare.com) This is why banks, mortgage servicers, health systems, and governments cannot treat the switch like a normal software patch. A mortgage record might need to stay trustworthy for 30 years, and every signature, certificate, hardware module, vendor connection, mobile app, and software update path has to keep working during the swap. (blog.google) Cloudflare’s 2029 target matters because it sits in the middle of the internet, not at the edge of it. When a company that proxies websites, protects application programming interfaces, runs zero-trust access, and connects corporate networks says authentication migration now comes first, that is less a product update than a signal that the internet’s plumbing is being rebuilt on a shorter clock. (blog.cloudflare.com)
