Skip to main content

One post tagged with "Post-Quantum"

Migrating the Internet to post-quantum cryptography — ML-KEM key agreement, ML-DSA signatures, hybrid handshakes, and the harvest-now-decrypt-later threat they answer.

View All Tags

Cloudflare Tunnel: post-quantum by default, not by guarantee

· 16 min read
Vadim Nicolai
Vadim Nicolai
Senior Software Engineer

The Cloudflare Tunnel overview states its promise in a single line: connect your origin servers, APIs, and services to Cloudflare "with post-quantum encrypted tunnels — no public IPs required."

That sentence describes the software's default behaviour. One level down, in the run-parameter reference, the same documentation explains what happens when the default does not hold. cloudflared connects over QUIC using post-quantum cryptography, the docs say, "but will fall back to non-PQ if there are issues connecting."

Both statements are accurate. The distance between them is one flag wide, and Cloudflare's own roadmap explains why that distance matters: "Adding support for PQ cryptography is not enough. Systems must disable support for quantum-vulnerable cryptography to be secure against downgrade attacks." The tunnel ships the support. The flag is how you disable the fallback.