Using HPKE to Encrypt Request Payloads
Feb 19, 2021Miguel de Moura, Andre Bluehs
Summary
This post details the implementation of Hybrid Public Key Encryption (HPKE) to securely encrypt and store debugging data for Firewall Rules. It covers the selection of HPKE based on its performance and standardization, the choice of Rust for implementation with WebAssembly compilation for cross-platform use (edge, dashboard UI, CLI), and the user-facing key generation and decryption process. The post also explains how matched data is extracted from HTTP requests using Wirefilter, tagged, processed, encrypted, and stored, with a focus on ensuring that Cloudflare itself cannot decrypt the sensitive data.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack