Cloudflare One is the first SASE offering modern post-quantum encryption across the full platform
Feb 23, 2026Sharon Goldberg, Amos Paul, David Gauch
Summary
This post details the integration of hybrid ML-KEM (Module-Lattice-based Key-Encapsulation Mechanism) for post-quantum encryption into Cloudflare One's SASE platform, specifically within Cloudflare IPsec and the Cloudflare One Appliance. It explains the importance of post-quantum cryptography for future security, the two key migrations (key agreement and digital signatures), and the technical challenges and solutions encountered in adapting IPsec for PQC, contrasting it with TLS's adoption.
More from the Random Number Generation for Security trail
- Support for modern cryptographic algorithms in Workers
- Using AI to chart a course for our post-quantum migration
- Post-quantum authentication to origins is now supported
- Why we cannot wait for better post-quantum signature algorithms
- The White House's post-quantum executive order is an important milestone. It’s time to get to work