A 2029 Target for Complete Post-Quantum Readiness
Cloudflare has revised its post-quantum security roadmap, setting a target of 2029 for full cryptographic readiness, including the critical piece: post-quantum authentication. The acceleration comes in response to recent, rapid developments in quantum computing that threaten the foundational cryptography used across the internet today.
The urgency stems from two major announcements that landed in the same week. First, Google disclosed—via a zero-knowledge proof rather than the algorithm itself—that it made a significant improvement to the quantum algorithm used to break elliptic curve cryptography. Second, Oratomic published a resource estimate for cracking RSA-2048 and P-256 on a neutral atom computer. The estimate for P-256 is particularly alarming: only 10,000 qubits would be required. Oratomic intentionally withheld specific implementation details from its publication.
These developments have shifted industry expectations. Google has already moved its own migration timeline up to 2029, with a notable emphasis on quantum-secure authentication over defensive measures against harvest-now/decrypt-later (HNDL) attacks. IBM's Quantum Safe CTO shares a more pessimistic outlook, suggesting quantum "moonshot attacks" on high-value targets cannot be ruled out as early as 2029.
The warning signs are unambiguous. Scott Aaronson noted that researchers working on detailed estimates for breaking deployed cryptosystems with Shor's algorithm would eventually stop publishing them, citing the risk of leaking strategic information to adversaries. Recent events confirm that this point has passed.
Three converging fronts
Predicting quantum progress is challenging because breaking cryptography requires advances on three independent engineering fronts: hardware, error correction, and software. Progress in one area compounds gains in the others. Recent weeks saw breakthroughs across all three.
Hardware. Neutral atom quantum computers emerged as a particularly promising approach alongside superconducting, ion-trap, photonics, and other architectures. Most of these technologies have made substantial progress, with neutral atoms leading the pack. Dismissing the threat would require believing that every single architectural approach will simultaneously hit a wall.
Error correction. Quantum error correction typically demands roughly a thousand physical qubits per logical qubit on superconducting hardware, which suffers from noise and limited connectivity. Neutral atom machines, with their reconfigurable qubits, were known to offer roughly an order-of-magnitude improvement. Oratomic's analysis shows the advantage is even more pronounced: only about three to four physical neutral atom qubits are required per logical qubit.
Software. The quantum algorithms themselves are getting faster. Google's breakthrough significantly accelerated the algorithm for breaking P-256. Oratomic then demonstrated architecture-specific optimizations that further reduce the computational burden.
Viewed together, the picture is clear: progress in neutral atom hardware, dramatically more efficient error correction, and software improvements have pulled Q-Day far forward from the 2035+ timelines many previously projected.
The authentication problem
For years, post-quantum cryptography has been framed around encryption—securing data against adversaries who harvest encrypted traffic today and decrypt it later with a quantum computer. Cloudflare has already deployed post-quantum encryption by default across most of its products and is working to close remaining gaps.
An imminent Q-Day makes the calculus very different. Broken encryption means data exposure. Broken authentication means compromise: an adversary with a quantum computer can impersonate servers, forge access credentials, or weaponize software-update mechanisms as remote code execution vectors. An active quantum attacker needs only one trusted quantum-vulnerable key to gain access—and will not be detected unless the intrusion is discovered or the key revoked.
Prioritizing long-lived keys and dependencies
The scarcity of early quantum computers will dictate attack patterns. First-generation quantum systems will make each decryption expensive and slow, steering attackers toward high-value targets: root certificates, API authentication keys, and code-signing certificates. These long-lived credentials granting persistent access should be the first priority for migration.
Adding post-quantum cryptography alone is insufficient. Systems must disable quantum-vulnerable algorithms to prevent downgrade attacks. This is difficult for federated systems such as the web, where legacy clients must be supported. Downgrade protection can still be achieved via "PQ HSTS" or certificate transparency mechanisms.
The migration effort extends beyond simply upgrading cryptography. Once a system is secured, all secrets previously exposed through quantum-vulnerable channels—passwords, tokens, and similar credentials—must be rotated. And the threat does not stop at organizational boundaries; even operators who secure their own infrastructure need to assess their third-party dependencies, both direct and indirect, for exposure.
With an accelerated timeline, post-quantum authentication is the new top priority over mere encryption updates. The work spans years because of dependency chains, the need to disable old algorithms, and the requirement to involve third-party validation and monitoring systems. Long-lived keys need to be upgraded more urgently than other infrastructure, but none of it can wait until 2029 to begin.
The path to full post-quantum protection
Cloudflare currently delivers post-quantum encryption across most of its product portfolio, a measure aimed at neutralizing harvest-now/decrypt-later attacks. That capability builds on more than a decade of work to harden customer traffic and the broader Internet infrastructure.
The company is now targeting 2029 for full post-quantum security, including authentication, across its entire product suite. The intermediate milestones along that route remain subject to revision as risk assessments and deployment realities shift.
Guidance for buyers, regulators, and customers
For enterprises, Cloudflare recommends making post-quantum support a contractual requirement in any new procurement. Standard hygiene — keeping software current and automating certificate issuance — covers much of the ground. The more pointed advice is to evaluate critical vendors early and determine the business impact if they fail to act.
Regulators and governments have played an outsized role by setting early timelines. The risk now, in Cloudflare's view, is fragmentation: divergent standards and uncoordinated effort across jurisdictions could stall momentum. The recommendation is for each government to designate a lead agency with the authority to drive migration on a clear schedule, anchored to existing international standards and focused on security outcomes. Urgency is warranted; panic is not.
Cloudflare customers need take no remedial steps for its services. Post-quantum protections have historically been enabled by default, with no configuration required, and the company says it will continue that approach. The unresolved side is what Cloudflare does not control: browsers, applications, and origin servers must also upgrade. For corporate traffic, Cloudflare One provides end-to-end post-quantum protection when tunnelling through its encrypted infrastructure.
Free by default
Post-quantum upgrades will remain available to every customer on every plan at no additional cost. Cloudflare frames this as a continuation of the philosophy behind its free TLS offering, which helped drive encryption across the web. Free post-quantum cryptography, the company argues, is the only way to secure the Internet at scale rather than protecting only those who can pay.
