WARP client moves to post-quantum key agreement
Cloudflare has upgraded both its consumer WARP client (1.1.1.1) and its enterprise WARP client, the Cloudflare One Agent, to support post-quantum key agreement. The move is part of a broader industry transition driven by NIST's timeline, which calls for classical cryptography (RSA, ECC) to be deprecated by 2030 and completely disallowed by 2035. Cloudflare reports that more than 45% of human-generated Internet traffic to its network is already post-quantum encrypted.
The upgrade gives end users immediate protection against harvest-now-decrypt-later attacks: encrypted traffic collected today cannot later be decrypted by a sufficiently powerful quantum computer. This protection holds even when the individual connections routed through the tunnel have not themselves been upgraded to post-quantum cryptography.
In the enterprise deployment, when the Cloudflare One Agent connects employees to internal corporate resources as part of the Cloudflare One Zero Trust platform, traffic is wrapped in a post-quantum encrypted MASQUE tunnel (Multiplexed Application Substrate over QUIC Encryption) sent to Cloudflare's global network. The network then forwards traffic through additional post-quantum encrypted tunnels to a cloudflared agent installed near the corporate resource.
For consumer users of the 1.1.1.1 WARP client, traffic is similarly wrapped in a post-quantum encrypted MASQUE tunnel to Cloudflare's global network. From there, it travels over post-quantum tunnels as close as possible to its final destination, then over the public Internet to the origin server. That last connection is post-quantum only if the origin server supports PQC and the client does as well; if the origin is behind Cloudflare, Automatic SSL/TLS will eventually ensure the full connection is post-quantum even when the browser isn't.
Where the cryptography stands
Post-quantum key agreement addresses the most urgent threat. Classical key agreement in TLS typically relies on Elliptic Curve Diffie Hellman (ECDH), which is vulnerable to Shor's algorithm on a quantum computer. Replacing it with post-quantum key agreement stops harvest-now-decrypt-later attacks, a concern for any institution — governments, financial institutions, healthcare organizations — whose data could remain sensitive for years.
The underlying algorithm, ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), is mature and performant. Cloudflare's experiments show that deploying ML-KEM in hybrid mode alongside classical ECDH over TLS 1.3 outperforms TLS 1.2 with classical cryptography alone.
Post-quantum digital signatures and certificates are a different story. They remain in the process of standardization for use in TLS and the Internet's Public Key Infrastructure (PKI). These are needed to defend against an active attacker with a quantum computer who could forge a certificate and impersonate a trusted server. No such attacker is known to exist today, so PQ signatures and certificates are not yet widely deployed. Cloudflare has not upgraded the WARP client to PQ signatures and certificates, but says it plans to do so soon.
Phased migration: balancing robustness and downgrade protection
Upgrading the WARP client to post-quantum key agreement is fundamentally different from upgrading a Cloudflare-controlled server. The client runs on millions of end-user devices across five operating systems (Windows, macOS, Linux, iOS, and Android/ChromeOS), which Cloudflare does not control. A release must work correctly on the first attempt. The client also relies on the MASQUE protocol, standardized only in August 2022, so the PQC migration must avoid exposing latent bugs or instabilities in that protocol itself.
To manage this carefully, Cloudflare adopted three techniques: temporary PQC downgrades, gradual population rollout, and a Mobile Device Management (MDM) override.
Cryptographic downgrades, by design
In cryptography, a downgrade attack forces a system to abandon a secure algorithm for an older, weaker one. When rolling out new post-quantum encryption, the standard requirement is that if both client and server support PQC, an attacker must not be able to force a downgrade to classical cryptography. That implies failing the connection if PQC negotiation fails — but that sacrifices robustness.
Robustness and downgrade security cannot coexist in the same phase. Cloudflare therefore split the rollout:
- Phase 1 — automated PQC downgrades. Clients that fail PQC negotiation automatically fall back to classical cryptography. This prioritizes robustness. Because MASQUE establishes a single long-lived TLS connection at login, users are unlikely to notice a downgrade.
- Phase 2 — PQC with downgrade protection. Once the rollout is stable, connections that fail PQC negotiation fail entirely. This provides security against downgrade attacks.
An API flag governs the client's TLS handshake behavior in three states:
- No PQC: classical cryptography only.
- PQC downgrades allowed: attempt post-quantum key agreement, fall back to classical on failure (Phase 1).
- PQC only: attempt post-quantum key agreement, fail the connection on failure (Phase 2).
This flag ships with WARP desktop version 2025.5.893.0, iOS version 1.11, and Android version 2.4.2.
Gradual rollout across the client fleet
To limit exposure to migration-triggered bugs, Phase 1 began with the API flag set to "No PQC" for all clients, then progressively switched groups to "PQC downgrades allowed." Downgrade events are monitored as an indicator of latent issues. At the time of writing, Phase 1 is complete for all consumer WARP (1.1.1.1) clients; completion for the Cloudflare One Agent is expected by the end of 2025.
Users who suspect PQC-related issues can report them via the feedback button (bug icon) in the WARP client interface; enterprise users can file a support ticket for the Cloudflare One Agent. Phase 2 — setting the flag to "PQC only" — is planned for summer 2026.
MDM override for early adopters
Organizations that want PQC immediately can activate it ahead of the default rollout. The Cloudflare One Agent supports an enable_post_quantum MDM flag that administrators can set to true. This flag takes precedence over the API flag signal and forces PQC-only connections — negotiation failure means connection failure, providing downgrade protection from the start.
FIPS compliance and ciphersuites
Cloudflare's FedRAMP certification requires FIPS-compliant cryptographic ciphersuites for products inside its FIPS boundary, which includes the WARP client. For internal links within that boundary, Cloudflare uses a hybrid key agreement: FIPS-compliant ECDH on the P256 elliptic curve, in parallel with an early version of ML-KEM-768 (P256Kyber768Draft00), which predates the finalized ML-KEM standards.
The warp-cli tunnel stats utility shows which ciphersuite is in use, as illustrated above.
Broad PQC tunnel coverage
Post-quantum key agreement on tunnels protects Internet traffic in bulk from harvest-now-decrypt-later attacks, even when the individual connections inside the tunnel have not yet been upgraded. This staged approach will eventually add post-quantum signatures and certificates to defend against active attacks after Q-Day. Tunnels also provide cryptographic agility, allowing adaptation to future cryptographic changes without architectural overhauls.
The WARP client is the latest Cloudflare tunneling product to adopt post-quantum key agreement. It is available free for personal devices via the consumer WARP client 1.1.1.1, and for corporate use via the free zero-trust offering for teams under 50 users or paid enterprise zero-trust/SASE subscriptions. The client runs on Windows, Linux, macOS, iOS, and Android/ChromeOS.
