Securing today for the quantum future: WARP client now supports post-quantum cryptography (PQC)

This post announces the upgrade of Cloudflare's WARP client (both consumer 1.1.1.1 and enterprise Cloudflare One Agent) to support post-quantum key agreement. This upgrade provides immediate protection against harvest-now-decrypt-later attacks by establishing MASQUE tunnels with post-quantum key agreement. For the Cloudflare One Agent, this enables end-to-end quantum encryption for traffic to internal corporate resources. For the consumer WARP client, it provides post-quantum key agreement for traffic to the internet, even if the final destination server does not yet support PQC. The post details the cryptographic primitives involved, highlighting the maturity and performance of ML-KEM for key agreement and contrasting it with the ongoing standardization of post-quantum digital signatures. It also outlines the unique challenges of upgrading client software on end-user devices and the strategies employed: temporary PQC downgrades, gradual rollout, and MDM overrides.