Post-quantumify internal services: Logfwrdr, Tunnel, and gokeyless
Feb 25, 2022Sofía Celi, Goutam Tamvada, Thom Wiggers

Summary
This post details Cloudflare's ambitious initiative to 'post-quantum-ify' its internal connections, starting with TLS. It outlines the challenges of migrating dozens of services across various programming languages to use post-quantum cryptography, focusing on the confidentiality aspect of TLS. The post explains the adoption of a 'hybrid' mechanism combining classical and post-quantum algorithms (Kyber-512 with P-256) for TLS 1.3 key exchange, ensuring security and compliance. It also touches upon the reasons for not immediately migrating the authentication phase of TLS and the services targeted for this initial migration.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack