A clearer path to quantum-safe origins

The industry-wide shift to post-quantum cryptography is often framed as a distant concern, but the reality is more urgent: encrypted traffic captured today can be decrypted later by a sufficiently powerful quantum computer. The cryptographic community has settled on the post-quantum standards that will anchor security for the coming decades, with formal releases expected in 2024. For most organizations, the transition will amount to a software update — but only if that software is maintained and inventoried, which isn't true everywhere.

For Cloudflare Tunnel users, that upgrade path is now more direct. Cloudflare has introduced Post-Quantum Cloudflare Tunnel, a beta feature that lets administrators secure the connection between their origin servers and Cloudflare's network with post-quantum key exchanges. This is a meaningful step because it extends quantum-safe protection to the last leg of the connection — the link from Cloudflare's edge to the customer's infrastructure — without requiring changes to the application itself.

How Cloudflare Tunnel works

Cloudflare Tunnel exposes an internal server to the internet by running the cloudflared service alongside it. The service establishes long-lived outbound connections to two nearby Cloudflare data centers. When a user visits the domain, their request hits a Cloudflare server, which relays it to one of the data centers holding an active cloudflared connection. From there, the request travels over the reverse connection to the cloudflared process, which forwards it to the application over the internal network.

Life of a Cloudflare Tunnel request.

The service's value extends beyond simple connectivity. Tunnel traffic inherits Cloudflare's DDoS protection, can be gated with Cloudflare Access for fine-grained control, and generates request logs for auditing. Post-quantum support now adds another layer: with the --post-quantum flag introduced in cloudflared 2022.9.1, the connection from cloudflared to Cloudflare's network becomes post-quantum secure. This complements Cloudflare's existing support for post-quantum browser connections to its edge.

This doesn't yet make the full path quantum-safe. The connections between Cloudflare's data centers are not yet post-quantum, and browsers don't currently support the post-quantum security Cloudflare offers at its edge. But each segment that becomes quantum-safe removes one opportunity for an attacker to intercept data with the intent of decrypting it later.

Enabling the beta

The feature is in beta because the underlying cryptography and its integration into the network protocol are not yet finalized. Forcing post-quantum as the default now would require cloudflared users to update more frequently than is reasonable. For those comfortable with that cadence, enabling it is straightforward.

Run cloudflared with the --post-quantum flag:

$ cloudflared tunnel run --post-quantum tunnel-name
2022-09-23T11:44:42Z INF Starting tunnel tunnelID=[...]
2022-09-23T11:44:42Z INF Version 2022.9.1
2022-09-23T11:44:42Z INF GOOS: darwin, GOVersion: go1.19.1, GoArch: amd64
2022-09-23T11:44:42Z INF Settings: map[post-quantum:true pq:true]
2022-09-23T11:44:42Z INF Generated Connector ID: [...]
2022-09-23T11:44:42Z INF cloudflared will not automatically update if installed by a package manager.
2022-09-23T11:44:42Z INF Initial protocol quic
2022-09-23T11:44:42Z INF Using experimental hybrid post-quantum key agreement X25519Kyber768Draft00
2022-09-23T11:44:42Z INF Starting metrics server on 127.0.0.1:53533/metrics
2022-09-23T11:44:42Z INF Connection [...] registered connIndex=0 ip=[...] location=AMS
2022-09-23T11:44:43Z INF Connection [...] registered connIndex=1 ip=[...] location=AMS
2022-09-23T11:44:44Z INF Connection [...] registered connIndex=2 ip=[...] location=AMS
2022-09-23T11:44:45Z INF Connection [...] registered connIndex=3 ip=[...] location=AMS

If cloudflared runs as a service, add post-quantum: true to the tunnel configuration file. The service auto-updates itself when not installed through a package manager. When the flag is set, cloudflared will not fall back to a non-post-quantum connection if the secure handshake fails; it will instead report an error:

2022-09-22T17:30:39Z INF Starting tunnel tunnelID=[...]
2022-09-22T17:30:39Z INF Version 2022.9.1
2022-09-22T17:30:39Z INF GOOS: darwin, GOVersion: go1.19.1, GoArch: amd64
2022-09-22T17:30:39Z INF Settings: map[post-quantum:true pq:true]
2022-09-22T17:30:39Z INF Generated Connector ID: [...]
2022-09-22T17:30:39Z INF cloudflared will not automatically update if installed by a package manager.
2022-09-22T17:30:39Z INF Initial protocol quic
2022-09-22T17:30:39Z INF Using experimental hybrid post-quantum key agreement X25519Kyber512Draft00
2022-09-22T17:30:39Z INF Starting metrics server on 127.0.0.1:55889/metrics
2022-09-22T17:30:39Z INF 

===================================================================================
You are hitting an error while using the experimental post-quantum tunnels feature.

Please check:

   https://pqtunnels.cloudflareresearch.com

for known problems.
===================================================================================

2022-09-22T17:30:39Z ERR Failed to create new quic connection error="failed to dial to edge with quic: CRYPTO_ERROR (0x128): tls: handshake failure" connIndex=0 ip=[...]

Setup is the only phase that differs from a standard tunnel. Once established, performance and reliability should be identical to that of a regular tunnel. The post-quantum key exchange is fast and adds roughly a kilobyte to the handshake, which should be imperceptible in practice.

The primary risk is that some middleboxes or network equipment might reject the larger handshake packets. If a post-quantum tunnel fails to establish, Cloudflare asks users to report the issue along with details about their ISP or intermediary devices.

Cryptographic details

With the flag enabled, cloudflared restricts itself to the QUIC transport for the tunnel connection and accepts only two hybrid post-quantum key exchanges: X25519Kyber512Draft00 and X25519Kyber768Draft00, identified in TLS as 0xfe30 and 0xfe31 respectively. Both combine the classical X25519 with Kyber, the post-quantum algorithm — a hybrid design that preserves classical security even if Kyber is eventually broken.

The client randomly selects between the two schemes. The reason is practical: X25519Kyber768Draft00 typically requires two initial packets for the TLS ClientHello due to its size, while X25519Kyber512Draft00 fits in one. Random selection lets Cloudflare test whether fragmented ClientHello messages cause interoperability problems in the wild.

When a post-quantum connection fails, cloudflared reports the attempted key exchange, its own version, and the error to a public status page, giving the team visibility into network-level issues. The control connection and authentication between cloudflared and Cloudflare's network are not yet post-quantum secure, though this is considered lower priority than protecting tunnel data from the store-now-decrypt-later threat.

Cloudflare has also open-sourced its Go implementation of post-quantum QUIC key exchanges, allowing broader adoption and review of the code.

Outlook

The coming years will see post-quantum protection rolled out across the industry, sometimes as a trivial update and sometimes as a harder migration. Post-Quantum Cloudflare Tunnel addresses one of the more awkward segments — the origin connection — in a way that requires no application changes. It's a practical step toward a fully quantum-safe internet, where users and origins can continue to rely on private, secure communication.