Post-quantum protection arrives for Zero Trust traffic

Quantum computers that can break today's public-key cryptography are no longer a theoretical concern. With significant advances in quantum hardware and a formal deprecation timeline from NIST — RSA and Elliptic Curve Cryptography are slated to be deprecated by 2030 and disallowed by 2035 — the transition to post-quantum algorithms has become an urgent operational issue.

The primary near-term risk is the "harvest now, decrypt later" attack. Adversaries can intercept and store encrypted traffic today, then decrypt it once a sufficiently powerful quantum computer exists. This makes protecting data in transit a matter of urgency, even before quantum computers can actively break connections.

The challenge of crypto-agility

History shows that removing outdated cryptography from live systems is slow. MD5 was proven insecure in 2004, yet remained in use with the RADIUS protocol until an attack exploiting it was disclosed in July 2024, with Cloudflare contributing to that research. The lesson applies directly to post-quantum migration: upgrading cryptographic libraries and protocols across legacy systems is difficult enough that the process should start well before algorithms are formally deprecated.

There is also regulatory momentum. In January 2025, the White House issued Executive Order 14144, which directs government agencies to require post-quantum cryptography support in product solicitations once a product category is deemed to have widely available PQC offerings.

A phased approach to TLS 1.3 migration

Cloudflare's post-quantum strategy has centered on TLS 1.3, which secures not just web traffic but also email, messaging, VPNs, DNS, and other protocols. The migration focuses on two distinct components of TLS 1.3: key agreement and digital signatures.

Phase 1: Key agreement. Work on post-quantum key exchange is most advanced, with ML-KEM emerging as the standard. Cloudflare reports that over 35% of non-bot HTTPS traffic reaching its network is already protected by TLS 1.3 with hybrid ML-KEM key exchange. This phase is a priority for two reasons:

  • Performance: ML-KEM works well with TLS 1.3, even on short-lived connections.
  • Security: Post-quantum key agreement directly mitigates harvest-now-decrypt-later attacks, since the shared secret used to encrypt traffic cannot later be recovered by a quantum computer.

Users can verify the hybrid key exchange in Chrome by opening DevTools, navigating to the Security tab, and checking for the identifier X25519MLKEM768, which indicates ML-KEM combined with conventional X25519 elliptic curve cryptography.

Phase 2: Digital signatures. Post-quantum signatures are significantly larger and slower, which has hindered adoption, particularly for short-lived TLS connections. They are also not required to defend against harvest-now-decrypt-later attacks; they protect against an adversary actively tampering with live connections using a quantum computer, a threat that is further off. Cloudflare is participating in standardization efforts and experimenting with new approaches for post-quantum authentication without sacrificing performance.

Quantum-safe Zero Trust use cases

The Zero Trust platform can now route corporate traffic through quantum-safe connections, allowing customers to protect against quantum threats without upgrading every internal application. Three configurations are available or coming:

Clientless Access for web applications

Clientless Cloudflare Access — which verifies identity and device context for HTTPS requests to corporate apps from a web browser — now provides end-to-end post-quantum protection. This works across three segments of the connection path:

  • Browser to Cloudflare: The connection is secured via TLS 1.3 with post-quantum key agreement, provided the browser supports it.
  • Within Cloudflare's network: Inter-datacenter hops are also secured with TLS 1.3 and post-quantum key agreement.
  • Cloudflare Tunnel to origin: The tunnel from the customer's environment to Cloudflare's network uses post-quantum key agreement.

This protects corporate HTTPS applications end-to-end without requiring customers to modify the applications themselves.

WARP client-to-tunnel configurations

For non-HTTPS protocols, organizations can use Cloudflare Tunnel and the WARP device client as a VPN replacement. By mid-2025, the WARP client will support post-quantum key agreement over the MASQUE protocol, complementing the existing post-quantum protection on inter-datacenter hops and Cloudflare Tunnel connections. Once complete, this will allow organizations to encapsulate traffic of any protocol in quantum-safe tunnels, protecting it against harvest-now-decrypt-later attacks without upgrading individual networks.

Secure Web Gateway for third-party traffic

Cloudflare Gateway now acts as a quantum-safe secure web gateway for HTTPS traffic. Gateway establishes two post-quantum TLS connections: one from the user's browser to Cloudflare's inspection point, and another from Cloudflare's network to the third-party origin server. The second connection works when the origin supports post-quantum key agreement. This protection applies regardless of how the user reaches Cloudflare's network — browser, WARP client, WARP Connector, or Magic WAN. For testing, customers can use https://pq.cloudflareresearch.com/ as a third-party origin server that supports post-quantum key agreement.

Availability

Quantum-safe clientless Access and Secure Web Gateway are available now. Post-quantum support for the WARP client-to-tunnel configuration is targeted for mid-2025. Behind the scenes, the focus remains on making the platform crypto-agile so that customers are shielded from the complexity of upgrading cryptographic algorithms as standards evolve.