TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Privacy Protocol CLI Tooling

2 posts · Oct 2021 – Oct 2026

What this trail covers

Cloudflare's privacy-preserving infrastructure continues to expand with the introduction of the Cloudflare OHTTP Gateway. This managed service, deployed globally across Cloudflare's network, allows customers to receive Oblivious HTTP (OHTTP) traffic, enabling app servers to receive HTTP requests without seeing user IP addresses or TLS fingerprints. This complements the existing Cloudflare OHTTP Relay, offering a choice between self-hosted or managed gateways. The OHTTP Gateway integrates seamlessly with existing zones, intercepting OHTTP requests to a `/.well-known/ohttp-gateway` endpoint, decrypting them, issuing subrequests to app servers, and returning encrypted responses. It supports both standard and chunked OHTTP, with a focus on minimizing latency and operational overhead for developers. This evolution aims to make privacy-preserving infrastructure more accessible and easier to adopt.

All Cloudflare trails
  1. Announcing Cloudflare OHTTP Gateway – expanding access to Cloudflare’s privacy-preserving infrastructureThis post announces the launch of the Cloudflare OHTTP Gateway, a new managed service that acts as an OHTTP gateway. It details how the gateway integrates with existing Cloudflare zones, intercepts OHTTP requests at a specific endpoint, decrypts them using Hybrid Public Key Encryption (HPKE), forwards them to app servers as regular HTTP requests, and then encrypts the responses before returning them to the client. The post highlights the benefits of this managed service, including reduced latency due to global deployment on Cloudflare's edge network, automatic scaling, and simplified onboarding compared to self-hosting an OHTTP gateway. It also clarifies the distinction between the new OHTTP Gateway and the existing OHTTP Relay, emphasizing the separation of trust model.
  2. We’re open sourcing our privacy proxy CLIThis post introduces the open-sourcing of 'privacy-client' (pvcli), a CLI tool designed to simplify the debugging and operation of privacy-preserving protocols like Oblivious HTTP (OHTTP). It addresses the complexity of manual binary parsing, encryption, and multi-party communication by providing a unified interface inspired by curl. The tool handles OHTTP requests, including fetching public keys, constructing binary HTTP, and encrypting requests, significantly reducing the friction in development and incident response for privacy products. The post details the challenges of debugging OHTTP without pvcli and demonstrates its usage with an OHTTP request example.
  3. Privacy Gateway: a privacy preserving proxy built on Internet standardsThis post introduces Privacy Gateway, a new service built on the Oblivious HTTP (OHTTP) standard and hybrid public-key cryptography. Privacy Gateway acts as a privacy-preserving proxy, encrypting HTTP requests and responses between clients and application servers. It ensures that Cloudflare does not see the content of requests, and application servers do not see the client's IP address or other identifying network information. The post details the architecture, data flow, and the concepts of request privacy and client privacy, providing examples of use cases such as privacy-respecting telemetry collection and secure healthcare site visits. It also outlines the server-side integration requirements, including publishing public keys and decrypting encapsulated requests.
  4. Stronger than a promise: proving Oblivious HTTP privacy propertiesThis post details the formal, computer-aided security analysis of the Oblivious HTTP (OHTTP) protocol using the Tamarin theorem prover. It describes the protocol's design for decoupling sender identity from request content, its use of HPKE and Binary HTTP, and the simplified security model and goals. The analysis aims to prove that OHTTP prevents linkability of requests to clients and future requests, even when the relay or gateway is compromised, by modeling the protocol's behavior with multiset rewriting rules.
  5. Private by design: building privacy-preserving products with Cloudflare's Privacy EdgeThis post introduces Privacy Edge, a suite of products including Privacy Gateway, Code Auditability, Private Proxy, and Cooperative Analytics, designed to build privacy into applications by default. Privacy Gateway leverages Oblivious HTTP (OHTTP) and HPKE to encrypt requests, blinding the relay to application data while the application server remains unaware of the user's IP address. Code Auditability uses hashing and a browser extension to verify code integrity, demonstrated with WhatsApp Web. Private Proxy provides VPN-like protection by encrypting traffic, replacing IP addresses with Cloudflare IPs, and using cryptographic tokens for authentication. Cooperative Analytics employs the Distributed Aggregation Protocol (DAP) for privacy-preserving measurement and analytics, splitting inputs into shares distributed across non-colluding servers.
  7. Privacy-Preserving Compromised Credential CheckingThis post introduces MIGP (Might I Get Pwned), a next-generation, privacy-preserving compromised credential checking protocol. MIGP allows clients to check for leaked credentials without leaking any information about the queried password to the service, and only a small amount of information about the queried username. It advances upon current state-of-the-art by allowing clients to check if similar passwords have been exposed, not just exact matches. The protocol was designed by researchers at Cornell Tech and the University of Wisconsin-Madison. Cloudflare has released a public demo and an open-sourced Go implementation. The post details the threat of data breaches, the evolution of credential checking services like Have I Been Pwned and Google Password Checkup, and the limitations of existing approaches. It explains the MIGP protocol's mechanisms for similarity-aware checking (client-side generation and server-side precomputation) and countermeasures against breach extraction attacks.