Random Number Generation for Security

7/29/2026

This post details the implementation of post-quantum authentication for Cloudflare-to-origin connections using ML-DSA signatures. It covers the configuration of Authenticated Origin Pulls (AOP) and Custom Origin Trust Store (COTS) products to support ML-DSA CAs and client certificates. The post also provides detailed instructions for generating ML-DSA certificates and configuring these products via the Cloudflare API, emphasizing the importance of avoiding downgrade attacks.

7/9/2026

This post details the latest developments in post-quantum signature algorithms, comparing candidate algorithms like FN-DSA, HAWK, and others against standardized ML-DSA and classical algorithms. It analyzes their sizes, CPU times for signing and verification, and discusses their strengths and weaknesses, particularly for use in TLS. The post highlights the trade-offs between different algorithms, such as SQIsign's small signatures but slow signing, and the lack of a single 'all-star' algorithm, necessitating a pragmatic approach to migration using available algorithms like ML-DSA while continuing research into more optimal future solutions.

6/23/2026

This post discusses the White House's Executive Order 14412, mandating federal agencies and contractors to transition to post-quantum cryptography (PQC) by specific deadlines (2030 for encryption, 2031 for authentication). It highlights Cloudflare's proactive work in this area, including its own 2029 readiness target and the deployment of PQC across various products. The post analyzes the EO's requirements, differentiates between post-quantum encryption and authentication, and discusses the challenges and importance of migrating to PQC, particularly for federal contractors. It also mentions Cloudflare's contributions to standards development via the IETF and its efforts to address performance issues with post-quantum authentication, such as Merkle Tree Certificates.

4/30/2026

This post announces the general availability of post-quantum encryption for Cloudflare IPsec, utilizing hybrid ML-KEM (FIPS 203) based on IETF draft standards. It highlights successful interoperability testing with Cisco and Fortinet, enabling protection of wide-area networks against harvest-now-decrypt-later attacks. The post also explains the technical implementation of the hybrid IPsec handshake and discusses the reasons for the slower adoption of PQC in IPsec compared to TLS, emphasizing the importance of interoperable standards for widespread adoption.

4/7/2026

This post announces an accelerated timeline for Cloudflare's post-quantum security roadmap, now targeting 2029 for full post-quantum security, including authentication. It highlights recent advancements in quantum computing research (Google's improved elliptic curve breaking algorithm, Oratomic's resource estimates for breaking RSA-2048 and P-256) that have pulled forward the estimated Q-Day. The post emphasizes the shift in industry focus from post-quantum encryption (mitigating harvest-now/decrypt-later attacks) to post-quantum authentication, as broken authentication is considered catastrophic. It discusses the prioritization of long-lived keys, the necessity of disabling quantum-vulnerable cryptography to prevent downgrade attacks, and the subsequent need to rotate secrets.

2/27/2026

This post introduces new security-related data sets and tools on Cloudflare Radar. It extends post-quantum (PQ) monitoring to origin-facing connections, allowing users to check any website's PQ encryption compatibility. A new Key Transparency section on Radar provides a public dashboard for real-time verification status of Key Transparency Logs for E2EE messaging services. Routing Security insights are expanded with global, country, and network-level information about ASPA deployment. The post details the methodology for measuring origin PQ support using an automated TLS scanner and the Go container leveraging the `crypto/tls` package. It also introduces a tool to test specific hostnames for PQ encryption support, which uses Cloudflare Containers and the Radar API.

2/23/2026

This post details the integration of hybrid ML-KEM (Module-Lattice-based Key-Encapsulation Mechanism) for post-quantum encryption into Cloudflare One's SASE platform, specifically within Cloudflare IPsec and the Cloudflare One Appliance. It explains the importance of post-quantum cryptography for future security, the two key migrations (key agreement and digital signatures), and the technical challenges and solutions encountered in adapting IPsec for PQC, contrasting it with TLS's adoption.

1/27/2026

This post demonstrates the practical application of post-quantum cryptography (PQC) by porting a Matrix homeserver to Cloudflare Workers. It highlights how Cloudflare's existing PQC deployment for TLS 1.3 (X25519MLKEM768) automatically protects all connections to the serverless homeserver, offering a significant advantage over traditional deployments which would require complex upgrades and testing. It also showcases the use of Cloudflare's serverless and storage primitives (Workers, D1, KV, R2, Durable Objects) to build a cost-effective, low-latency, and secure Matrix homeserver, further integrating PQC into a real-world application.

10/30/2025

This post explores the application of post-quantum cryptography to Anonymous Credentials (ACs), a privacy-preserving mechanism for proving specific facts without over-sharing information. It discusses the challenges of migrating classical AC primitives to PQ alternatives, the requirements for PQ ACs (including blind signatures, state management, nullifiers, and public attributes), and the current landscape of classical and emerging PQ AC research, including efforts at the IETF and potential use cases like private rate-limiting for AI agents.

10/28/2025

Introduces Merkle Tree Certificates (MTCs) as a proposal to redesign the WebPKI for post-quantum cryptography. MTCs aim to reduce the number of signatures and public keys in TLS handshakes to enable the deployment of quantum-safe certificates without performance degradation. The post details the current WebPKI's limitations with larger PQ signatures and outlines the MTC approach, which includes disseminating necessary information out-of-band and making certificate transparency a first-class feature. Cloudflare is also announcing an experimental deployment of MTCs in collaboration with Chrome Security.

10/28/2025

This post provides an update on the state of post-quantum cryptography migration on the internet, highlighting that the majority of human-initiated traffic with Cloudflare is now using post-quantum encryption. It details progress on quantum hardware (silicon-based, trapped-ion, topological qubits) and software, emphasizing Craig Gidney's optimizations that significantly reduced the estimated qubit count needed to break RSA-2048, effectively bringing Q-day closer. It also discusses the scare from Chen's algorithm and its subsequent debunking, reinforcing the current reliance on lattice-based cryptography.

10/16/2025

This post introduces the Web Application Integrity, Consistency, and Transparency (WAICT) initiative, a new approach to securing web applications by ensuring the integrity and transparency of JavaScript code. It details the challenges of client-side cryptography due to code distribution vulnerabilities and proposes solutions like integrity manifests and hash chains to provide app-store-like security guarantees for web applications. This significantly expands the scope of security beyond traditional cryptographic primitives to encompass the trustworthiness of the code itself.

9/24/2025

This post details the proactive upgrade of over 6 million domains to stronger TLS encryption modes by default using Automatic SSL/TLS. It highlights the importance of TLS protocol evolution, the challenges of securing the 'back door' between Cloudflare's edge and origin servers, and the transition towards post-quantum cryptography (PQC) with hybrid X25519 + MLKEM key agreement to prepare for future quantum computing threats.

9/24/2025

The WARP client (consumer 1.1.1.1 and Cloudflare One Agent) now supports post-quantum key agreement, enabling MASQUE tunnels that provide immediate post-quantum encryption of network traffic. This upgrade protects against harvest-now-decrypt-later attacks and is implemented across five operating systems. The rollout employs temporary PQC downgrades, gradual rollout, and MDM overrides for robustness.

9/19/2025

This post clarifies that post-quantum cryptography (PQC) is the primary solution for quantum readiness and can be deployed on existing hardware. It contrasts PQC with quantum technologies like Quantum Key Distribution (QKD) and Quantum Random Number Generation (QRNG), explaining why the latter are not necessary or sufficient for protecting against quantum adversaries. The post details the limitations of QKD, particularly its lack of scalability for internet-wide use and implementation challenges, and argues that investments in quantum technology should not be based on the need for quantum security.

3/24/2025

This post significantly advances the 'Random Number Generation for Security' thread by announcing the integration of post-quantum cryptography (PQC) into Cloudflare Zero Trust for corporate network traffic protection against quantum threats. It also introduces the concept of cryptographic watermarks for AI-generated content, indicating a forward-looking approach to securing emerging technologies.

3/17/2025

This post details the integration of a new physical entropy source, a 'wall of entropy' composed of 50 wave machines, into Cloudflare's LavaRand system. It describes the artistic and engineering challenges in creating custom wave machines capable of 24/7 operation, the specific components and fluid used, and the process of capturing images of the chaotic wave motion to generate random bytes. This new source of entropy complements existing sources like lava lamps, suspended rainbows, and chaotic pendulums, contributing to the cryptographic security of Cloudflare's global infrastructure and services like Cloudflare Workers and the drand API.

3/17/2025

This post announces the first phase of end-to-end quantum readiness for Cloudflare's Zero Trust platform, enabling customers to protect corporate network traffic with post-quantum cryptography. It details the use of ML-KEM for key agreement in TLS 1.3 to protect against 'harvest now, decrypt later' attacks and secure internal applications via Cloudflare Tunnel, clientless Access, WARP device client, and Gateway. It also discusses the challenges of migrating away from RSA and ECC, the 'harvest now, decrypt later' threat, and the two-phase migration strategy focusing on key agreement first.

11/7/2024

This post analyzes fourteen post-quantum signature schemes advanced to the second round of NIST's competition for their feasibility in TLS. It details the TLS handshake process and the various signatures involved, then compares the performance characteristics (public key size, signature size, signing time, verification time) of these candidates against existing classical and standardized PQC schemes (ML-DSA, SLH-DSA, Falcon, LMS, XMSS). The analysis highlights the significant increase in data size for PQC signatures and public keys and discusses the implications for TLS handshake performance, particularly the impact on certificate data size.

8/20/2024

This post announces the finalization of NIST's first three post-quantum cryptographic standards (ML-KEM, ML-DSA, SLH-DSA) and discusses their significance for future-proofing communications against quantum computers. It details Cloudflare's ongoing efforts in PQC, including the deployment of a preliminary ML-KEM version (Kyber) to protect traffic and plans to upgrade to the final ML-KEM standard. It also addresses the challenges and timeline for adopting post-quantum signatures, highlighting the need for ecosystem-wide coordination.

3/8/2024

This post details the expansion of Cloudflare's LavaRand system to include new physical entropy sources from its London (double pendulums) and Austin (mobiles) offices, in addition to the original San Francisco lava lamps. It explains how images of these chaotic physical systems are captured, hashed to derive random bytes, and then used to seed a CSPRNG. The post also highlights how this enhanced randomness can be made available to external applications via an API for both private (e.g., key generation) and public (e.g., verifiable random draws, timelock encryption) use cases.

3/5/2024

This post provides an update on the state of post-quantum cryptography (PQC) adoption and its implications for the Internet. It highlights the increasing percentage of TLS 1.3 connections secured with PQC, the timelines for quantum computer development and their threat to current cryptography, and the two main migration paths: key agreement and signatures/certificates. It also clarifies that symmetric cryptography is already post-quantum secure. The post emphasizes the urgency of migration due to the 'harvest now, decrypt later' threat.

9/29/2023

This post announces the General Availability (GA) of post-quantum cryptography (PQC) support across Cloudflare's products and internal systems. It details the phased rollout plan for different customer tiers (Free, Pro/Business, Enterprise) and internal systems, with a target of full internal adoption by the end of 2024. The post lists the initial set of products and services included in the GA rollout, such as 1.1.1.1, R2, Argo Smart Routing, and WAF, and outlines future products slated for PQC support, including Cloudflare Gateway, DNS, and Workers. It reiterates the rationale for prioritizing PQC adoption due to the threat of quantum computers breaking current encryption and emphasizes that PQC will be included for free in all applicable Cloudflare products.

9/29/2023

This post details the rollout of X25519+Kyber for outbound connections from Cloudflare to origin servers and Cloudflare Workers fetch() calls. It explains the TLS 1.3 handshake, the role of HelloRetryRequest, and the hybrid nature of X25519+Kyber, which combines X25519 with a preliminary version of NIST's Kyber. The post also outlines the phased rollout plan for different Cloudflare plans and provides quick start instructions for enabling the feature, including API calls and Nginx configuration examples. It also mentions the future adoption of the ML-KEM standard.

3/16/2023

This post clarifies that AI has not broken the Kyber post-quantum cryptography algorithm, despite recent news reports. It explains side-channel attacks, including remote timing and power analysis, and discusses countermeasures like masking and constant-time implementations. The post details how machine learning, particularly deep learning, is used in profiling attacks to extract secret keys from side-channel measurements, but emphasizes that these attacks are complex and require careful tuning. It concludes that while AI is a powerful tool for security evaluators in side-channel analysis, it is still far from breaking most real-world targets.

3/16/2023

This post announces Cloudflare's commitment to making its post-quantum cryptography (PQC) implementations free and available forever to all customers. It details the integration of Kyber for key agreement in TLS 1.3 and HTTP/3, providing open-sourced forks for BoringSSL, Go, and quic-go to facilitate testing. The post also outlines Cloudflare's internal PQC adoption strategy, including upgrades to BoringSSL, TLS 1.3, and zero trust products, as well as contributions to open source projects like CIRCL. It emphasizes the importance of preparing for quantum threats and provides resources for customers to begin their PQC transition.

10/3/2022

This post details the deployment of hybrid post-quantum key agreement for TLS 1.3 connections, making it the default for all websites and APIs served through Cloudflare. It explains the threat of quantum computers to current cryptography, the role of post-quantum cryptography, and the technical details of how TLS 1.3 is adapted to support hybrid key agreements (combining traditional ECDH with PQ KEMs like Kyber). It also discusses the importance of early adoption for identifying and mitigating real-world issues with new cryptographic standards.

10/3/2022

Introduces Post-Quantum Cloudflare Tunnel, a beta feature that adds a `--post-quantum` flag to `cloudflared` to establish post-quantum secure connections between `cloudflared` and Cloudflare's network. It uses hybrid key exchanges (X25519Kyber768Draft00 and X25519Kyber512Draft00) over QUIC. The post also announces support for post-quantum browser connections and discusses the challenges of middlebox interference.

8/4/2022

Introduced experimental support for hybrid post-quantum key agreements (X25519Kyber512Draft00 and X25519Kyber768Draft00) in TLS handshakes for test domains. Open-sourced forks of BoringSSL and Go with PQC support to enable client-side experimentation and performance analysis. Detailed the on-wire packet flow differences between classical and hybrid PQC key exchanges. Explained the underlying hybrid design using X25519 and Kyber, and the TLS group identifiers used. Highlighted performance characteristics and potential trade-offs of Kyber compared to classical key agreements.

7/8/2022

This post details NIST's announcement of the first four post-quantum cryptographic algorithms to be standardized: Kyber for key agreement and three signature schemes. It explains the threat posed by Shor's algorithm and quantum computers to current public-key cryptography (key agreement and digital signatures). The post compares Kyber's performance and key/ciphertext sizes to existing schemes like X25519 and RSA, discussing the implications of larger sizes for TLS implementations. It also touches upon the other PQC finalists and their potential future standardization.

3/31/2022

This post details Cloudflare's work in making SaltStack post-quantum secure. This involved analyzing Salt's bespoke cryptographic protocol, discovering and helping to fix several security vulnerabilities (CVE-2022-22934, CVE-2022-22935, CVE-2022-22936), and proposing a path forward using mutually authenticated TLS (mTLS) for a more robust and future-proof transport. The findings highlight the challenges of post-quantum signature sizes and the benefits of mTLS for long-lived, authenticated connections.

2/25/2022

This post discusses the challenges and opportunities of migrating to post-quantum cryptography, focusing on the complexities of updating certificate-based authentication in TLS. It highlights the need to consider the impact of larger post-quantum signature sizes and computation times, the challenges of coordinating updates across the complex Public Key Infrastructure (PKI) ecosystem involving multiple actors, and the potential for rethinking the PKI system itself. It also touches upon alternative authentication mechanisms like KEMTLS.

2/25/2022

This post details Cloudflare's initiative to "post-quantum-ify" internal connections, specifically focusing on migrating TLS to use post-quantum cryptography. It explains the theoretical challenges and practical implementation of using a hybrid mechanism (classical + post-quantum algorithms like Kyber-512 and P-256) for TLS key exchange to ensure confidentiality against future quantum threats while maintaining FIPS compliance. The post also discusses the decision to defer post-quantum migration of the authentication phase of TLS due to external dependencies.

2/25/2022

This post introduces Hybrid Public Key Encryption (HPKE) as a new standard (RFC 9180) for public-key encryption. It details the motivation, design goals, and construction of HPKE, which aims to be simple, reusable, and future-proof. HPKE is built as a composition of a Key Encapsulation Mechanism (KEM), Key Derivation Function (KDF), and Authenticated Encryption Algorithm (AEAD), allowing for algorithm agility and supporting different authentication modes. The post provides a primer on public-key encryption, discusses the shortcomings of existing standards, and highlights HPKE's use in emerging protocols like Encrypted Client Hello and Oblivious DNS-over-HTTPS.

2/24/2022

This post introduces the concept of formal analysis and security proofs for cryptographic protocols, using KEMTLS as an example. It explains how process algebras and tools like Tamarin are used to model protocols, define security properties, and construct proofs by exploring all possible protocol runs. The post details the structure of Tamarin rules, including preconditions, actions, and postconditions, and how they are used to build a tree representing protocol execution paths.

2/24/2022

This post introduces the application of formal verification techniques, specifically using EasyCrypt and Jasmin, to ensure the correctness and security properties of cryptographic implementations, particularly in the context of post-quantum cryptography. It details the goals of formal analysis and verification, contrasting symbolic and computational analysis, and explains the process of turning natural language specifications into formal ones, proving algorithm properties, and verifying implementation correctness and additional properties like memory safety and constant-time execution.

2/23/2022

This post details the challenges and potential solutions for making TLS post-quantum. It analyzes the trade-offs between speed and size for various NIST post-quantum KEM and signature candidates, discussing their suitability for TLS key exchange and authentication. It also explores alternative approaches like using KEMs for authentication and the implications for certificate chain verification.

2/22/2022

This post introduces the concept of Key Encapsulation Mechanisms (KEMs) and details the construction of FrodoKEM, a post-quantum KEM. It explains the underlying mathematics, focusing on the Learning With Errors (LWE) problem and its hardness against quantum computers. The post breaks down the KEM construction into three algorithms (Generate, Encapsulate, Decapsulate) and illustrates how a Public Key Encryption (PKE) scheme like FrodoPKE can be transformed into a KEM.

2/22/2022

This post provides a deep dive into post-quantum signature schemes, specifically focusing on CRYSTALS-Dilithium. It explains the mathematical underpinnings, including the Short Integer Solution (SIS) problem and its relation to lattices, and details the algorithmic construction of Dilithium by first building an identification scheme and then transforming it into a signature scheme using the Fiat-Shamir transformation. The post aims to educate engineers on the principles behind quantum-resistant digital signatures.

2/21/2022

This post introduces a taxonomy of challenges posed by quantum computers and their threat to cryptography. It categorizes these challenges into five kingdoms: Protocols, Implementations, Standardization, Community, and Research. The 'Protocols' section details how quantum computers impact network, transport, and application layer protocols (e.g., IPsec, TLS, DNSSEC) by potentially compromising confidentiality, authentication, and integrity. It discusses the performance implications of larger post-quantum keys on bandwidth and latency, referencing past experiments with hybrid TLS handshakes and the challenges posed by middleboxes and protocol ossification. The post also highlights the difficulties in updating handshake authentication due to larger post-quantum signature sizes and explores potential solutions like KEMTLS.

2/21/2022

This post introduces the concept of quantum computing, explaining qubits, superposition, and entanglement. It highlights how quantum computers can efficiently solve problems like factoring large integers (Shor's algorithm) and searching unstructured databases (Grover's algorithm), which pose a significant threat to current cryptography. The post discusses the 'solace' of quantum computing in advancing computational problems and the 'spectre' it presents to secure connections. It also touches upon the challenges of building reliable quantum computers due to decoherence and the need for error correction, and mentions Google's goal of building an error-corrected quantum computer by the end of the decade.

11/8/2021

This post details Cloudflare's real-world experiment to measure the impact of larger post-quantum (PQ) signatures on TLS handshake times. It describes the methodology of using dummy certificates to emulate varying signature sizes and the experimental setup involving challenge pages and background requests to collect handshake timing data. The post highlights the challenges of PQ signature adoption, particularly the trade-offs between signature size, signing/verification speed, and client compatibility, and introduces the NIST finalists (Dilithium, Falcon, Rainbow) as candidates for future TLS security.

10/13/2021

This post announces a major update to the CIRCL library, introducing new packages for pairing-based cryptography. It explains the mathematical properties of pairings, including their bilinear map nature, and how they enable advanced cryptographic protocols like efficient three-party Diffie-Hellman key exchange and identity-based encryption. The post also touches upon the use of pairings in zk-SNARKs, drand, and BLS signatures, and briefly explains their mathematical origins in elliptic curve theory and divisors.

8/12/2021

Introduced a Zero-Knowledge Proof (ZKP) system for web attestation to enhance privacy. The system allows hardware security keys to prove their authenticity without revealing manufacturer or model information, addressing privacy concerns with the existing WebAuthn attestation mechanism. The ZKP is designed to be efficient for browser-based implementation and works with existing hardware. The code is open-sourced.

2/19/2021

This post details the implementation of Hybrid Public Key Encryption (HPKE) to securely encrypt sensitive request payloads for debugging Firewall Rules. It covers the algorithm requirements, the decision to use HPKE due to its performance and emerging standard status, the implementation in Rust and compilation to WebAssembly for cross-platform use (edge, dashboard UI, CLI), and the user-facing aspects of key generation and decryption. The process of payload extraction, rule matching, and serialization is also described.

1/15/2021

This post introduces KEMTLS, a novel mechanism for achieving post-quantum secure TLS handshakes without relying on traditional digital signatures. It proposes replacing the handshake signature with a post-quantum Key Encapsulation Mechanism (KEM) key exchange to reduce the size of transmitted data. The post details the motivation, past experiments, and the implementation of KEMTLS in Go, demonstrating a significant reduction in handshake data size compared to traditional post-quantum TLS approaches.

12/11/2020

This post details the threat posed by quantum computing to current cryptographic algorithms, specifically mentioning Shor's algorithm's ability to break RSA and ECC. It highlights Cloudflare's proactive engagement with post-quantum cryptography (PQC) through experiments like the TLS Post-Quantum Experiment with Google, the development of KEMTLS, and the implementation of NIST finalists (Kyber, Dilithium) in their CIRCL cryptography library. The post also outlines Cloudflare's internal goals for adopting PQC by the end of 2021 and offering PQC cipher suites to customers.

12/8/2020

This post introduces three new privacy-preserving protocols: Encrypted Client Hello (ECH) to encrypt SNI, Oblivious DNS-over-HTTPS (ODoH) for private DNS lookups, and OPAQUE for secure password authentication. It also highlights past contributions to Universal SSL, TLS 1.3, QUIC, RPKI, time synchronization, and DNS security, emphasizing a commitment to building a better Internet that respects user privacy by changing protocols to expose less sensitive data on the wire.

3/31/2020

This post details the results of an independent examination of Cloudflare's 1.1.1.1 public DNS resolver's privacy commitments. It clarifies that Cloudflare does not retain personal data from resolver users, does not link IP addresses with DNS queries, and truncates source IP addresses to anonymize them. The post also addresses a previous ambiguity regarding the retention of anonymous logs and clarifies the limited use of randomly sampled network packets for troubleshooting and DoS mitigation. Updated privacy commitments are provided, emphasizing that personal data will not be sold or shared, and that source IP addresses will be anonymized and deleted within 25 hours. Transaction and debug logs will also be deleted within 25 hours, with limited access granted to APNIC for research purposes.

3/4/2020

This post introduces a new security advancement for the Pwned Passwords API: padded responses. This feature uses Cloudflare Workers to dynamically generate random padding for API responses, preventing attackers from inferring user queries based on response size. It leverages cryptographically secure random number generators, seeded with entropy from sources like lava lamps and server-level randomness, to ensure unpredictable padding. The post also discusses the technical implementation, the low risk of false positives, and future work on more advanced protocols for compromised credential checking.

2/28/2020

This post introduces Cloudflare's exploration and implementation of AMD's Secure Memory Encryption (SME) on EPYC processors. This feature provides hardware-level encryption for data in RAM, addressing physical server theft and memory snooping vulnerabilities. The post details the components of SME, its transparent mode (TSME), and performance testing results, demonstrating a minimal performance impact. This adds a new layer of hardware-assisted security to protect data in use, complementing existing encryption strategies.

11/1/2019

This post details Cloudflare's multi-year project to make its platform more resilient against remote memory disclosure vulnerabilities like Heartbleed and Cloudbleed. The core of this effort is the 'Keyless Everywhere' initiative, which separates private keys from internet-facing processes. This was achieved by repurposing the Keyless SSL architecture, originally designed for customer-held keys, to manage Cloudflare's own private keys. The internal implementation, 'gokeyless-internal', was developed to handle millions of private keys at the edge, incorporating lazy loading and graceful upgrade mechanisms. The TLS 1.3 implementation and Spectrum were the first services to adopt this keyless architecture.

11/1/2019

This post introduces Delegated Credentials for TLS, a new cryptographic protocol developed in collaboration with industry partners to enable secure and performant TLS termination in global networks. It addresses the challenges of managing private keys remotely by allowing short-lived, delegated credentials to be pushed to servers, reducing latency and improving availability compared to previous 'Keyless SSL' approaches. This advancement also opens avenues for experimenting with new authentication algorithms and transitioning to post-quantum cryptography by allowing flexibility beyond the traditional Public Key Infrastructure (PKI).

10/31/2019

This post details Cloudflare's implementation of the Network Time Security (NTS) protocol in Rust, named 'cfnts'. It explains the NTS protocol's two stages (NTS-KE and NTPv4), the rationale for choosing Rust (memory safety, non-nullability, thread safety, immutability, error handling) over Go for performance-critical time synchronization, and the dependencies used (Mio, Rustls). It also highlights participation in IETF hackathons to ensure interoperability and the strategy of leveraging existing tools like chrony for clock adjustment while focusing on implementing the new secure time protocols.

10/30/2019

This post details a large-scale experiment conducted with Google to evaluate the performance and feasibility of deploying two post-quantum key agreement algorithms (SIKE and HRSS) within TLS 1.3. The experiment measured server-side handshake durations, comparing the performance of the post-quantum algorithms against the classical X25519. Results indicated that HRSS (CECPQ2) generally outperformed SIKE (CECPQ2b), suggesting that fast algorithms with large keys might be more suitable for TLS than slow algorithms with small keys. However, for the slowest connections on certain devices (Android, Linux, Windows), CECPQ2b showed better performance, potentially due to factors like packet fragmentation and loss. The experiment also analyzed the impact of session resumption, IP version, and network location on handshake latency, finding that session resumption significantly speeds up handshakes and that IPv6 connections were faster on desktop/laptop devices but slower on mobile devices.

10/28/2019

This post details the evolution of the Privacy Pass protocol, introducing version 2.0 of the browser extension with easier configuration, integration with hCaptcha, and compliance with new cryptographic standards. It also announces a new server backend using Cloudflare Workers for cryptographic operations and the public redemption API. The post highlights ongoing standardization efforts for oblivious pseudorandom functions (OPRFs) and the Privacy Pass protocol itself, emphasizing the commitment to privacy-preserving technologies and community collaboration.

10/28/2019

This post announces a week-long series of blog posts focused on cryptography. It highlights upcoming technical deep dives into Privacy Pass, Post-quantum Cryptography experiments in TLS, Cloudflare's Rust implementation of NTS (cfnts), DNS Encryption, and Delegated Credentials for TLS to secure private keys against memory disclosure attacks.

9/14/2019

This post details the use of lava lamps as an entropy source for Cloudflare's LavaRand system, which bolsters Internet encryption. It explains how video footage of lava lamps is captured and fed into the LavaRand algorithm to amplify randomness. The post also mentions the League of Entropy, a consortium of organizations generating verifiable randomness, and Cloudflare's role as a founding member.

6/20/2019

This post introduces quantum computing, its basic principles like superposition and measurement, and the concept of quantum gates (X and Z gates). It explains how quantum computers pose a threat to current cryptographic standards and sets the stage for subsequent posts discussing quantum-resistant algorithms and their implementation.

6/20/2019

This post details Cloudflare's involvement in experimenting with and deploying post-quantum (PQ) cryptographic algorithms for TLS connections. It describes the motivation behind PQ cryptography, the NIST standardization process, and the characteristics of different PQ algorithm families. Cloudflare, in collaboration with Google, is conducting a large-scale experiment to evaluate the performance of key-exchange algorithms like NTRU-based HRSS-SXY and isogeny-based SIKE in real-world TLS handshakes. The experiment aims to collect client- and server-side telemetry to understand latency impacts, network behavior, and the trade-offs between speed and key size for these PQ algorithms.

6/20/2019

This post introduces CIRCL, a new Go cryptographic library developed by Cloudflare. CIRCL provides implementations of post-quantum cryptography (SIDH, SIKE), elliptic curve cryptography (X25519, X448, FourQ, Ed25519), and hash functions for prime groups. It aims to be a complementary set of aggressively optimized or future-useful cryptographic primitives, distinct from the standard Go crypto libraries. The post details the SIKE implementation with code examples and discusses performance optimizations for various architectures. Future plans include adding lattice-based algorithms and post-quantum signature algorithms.

6/18/2019

This post introduces a new, free tool Cloudflare offers to Certificate Authorities (CAs) to secure certificate issuance by addressing vulnerabilities in Domain Control Validation (DCV). It details how BGP hijacking attacks (Sub-Prefix Attack and Equally-Specific-Prefix Attack) and DNS spoofing can be used to trick CAs into issuing certificates for domains the attacker does not own. The post explains the mechanisms of these attacks and highlights the critical need for more robust DCV methods to prevent certificate mis-issuance, which can lead to large-scale data breaches and trust erosion.

6/17/2019

Introduced the League of Entropy, a consortium of organizations providing a decentralized randomness beacon using the drand protocol. This enhances the trustworthiness and unpredictability of public randomness for applications like lotteries and election audits by aggregating entropy from multiple independent sources (Cloudflare's LavaRand, EPFL's URand, UChile's Seismic Girl, Kudelski Security's ChaChaRand, and Protocol Labs' InterplanetaryRand). The post clarifies that public randomness from beacons should not be used for private cryptographic keys.

6/17/2019

This post introduces the League of Entropy, a network of distributed beacons that produce publicly verifiable random outputs using threshold cryptography and the drand project. It details the cryptographic architecture, including distributed key generation and threshold signature schemes, to ensure randomness is verifiable and tamper-resistant. The post explains the concept of entropy, how randomness is sampled, and the benefits of distributed randomness over centralized sources, particularly in the context of security and trust in various applications.

6/16/2019

This post announces 'Crypto Week 2019', a series of daily announcements of new projects and services using modern cryptography to build a more secure, trustworthy Internet. It highlights the ongoing challenges in securing Internet protocols like BGP and DNS, and introduces several new initiatives: The League of Entropy, Securing Certificate Issuance using Multipath Domain Control Validation, Cloudflare's Ethereum Gateway, an improved IPFS Gateway, research into the Quantum Menace and Post-Quantum Cryptography in TLS, and the introduction of CIRCL (an advanced cryptographic library) and time.cloudflare.com (for secure time synchronization). The post emphasizes the need for principled commitment to upgrading the Internet's fundamental protocols and discusses the security implications of BGP hijacking and the role of RPKI and DNSSEC in mitigating these risks.

12/25/2018

This post presents a series of cryptography challenges from 2019, including a TLS Client Hello analysis, a Time-Based One-Time Password (TOTP) vulnerability, and an RPKI-based message decoding challenge. The solutions reveal insights into encrypted SNI, a flawed TOTP implementation lacking a shared secret, and the use of RPKI ROAs to hide messages. The post also includes hints and solutions for each challenge, demonstrating practical applications of cryptographic concepts.

9/29/2018

This post highlights significant differences in random number generation and encryption practices between Cloudflare and Glowbeam Technologies, emphasizing Cloudflare's use of multiple sources of randomness and adherence to standard encryption algorithms (like AES) over custom-built 'encryption engines'. It also notes Cloudflare's acquisition of Glowbeam Technologies' assets.

9/17/2018

This post announces Cloudflare's 'Crypto Week', a series of daily announcements introducing new technologies that use cryptography to improve the internet. The week's announcements include: Cloudflare's IPFS Gateway, E2E Integrity with IPFS, Expanding DNSSEC Adoption, RPKI for BGP routing security, Cloudflare Onion Service, and Roughtime for securing time with digital signatures. The post explains how cryptography, specifically hashes and digital signatures, can be used to build a more trustworthy internet by encoding and enforcing trust relationships in routing, DNS, and HTTPS.

12/28/2017

This post provides a detailed analysis of the CPU cost of various cryptographic algorithms used in TLS deployments at Cloudflare's scale. It breaks down the performance impact of symmetric encryption (AES-GCM, ChaCha20-Poly1305, AES-CBC), public-key operations (ECDHE with P256 and x25519, RSA signatures, ECDSA), and hash functions (SHA1, SHA2). The findings indicate that while modern ciphers are efficient, RSA remains a significant performance bottleneck. It also foreshadows the need for post-quantum cryptography.

12/26/2017

This post presents three cryptography challenges: password hashing using BCrypt, understanding HTTP Strict Transport Security (HSTS) implications for SSL stripping, and reversing AES-256 CTR mode encryption when the key and IV are identical. It details the cracking of BCrypt hashes using hashcat and a password list, explains how HSTS prevents practical SSL stripping attacks, and demonstrates a two-time pad attack on AES-CTR by XORing two ciphertexts encrypted with the same key and IV to recover the original plaintext.

12/24/2017

This post discusses the security challenges in IoT devices, specifically focusing on the difficulties of software updates and the overhead of TLS. It highlights TLS 1.3 as a solution to reduce handshake latency and the benefits of Elliptic Curve Cryptography (ECC) for reducing certificate size on resource-constrained devices. It also touches upon the plaintext nature of some IoT protocols like MQTT and CoAP.

12/22/2017

This post details the use of LavaRand, a wall of lava lamps, to feed entropy into random number generators across Cloudflare's network. It explains how the physical process of lava lamp fluid movement is captured by cameras and processed to generate high-quality random numbers for cryptographic purposes.

11/6/2017

This post details the technical implementation of Cloudflare's LavaRand system, which uses a wall of lava lamps as an additional entropy source for cryptographic randomness. It explains the concepts of true randomness vs. pseudorandomness, the importance of entropy pools in operating systems, and the security considerations of randomness generation. The LavaRand design involves a camera capturing the lava lamps, a server mixing this entropy with its own, and a production service further combining it with local entropy. Potential attacks and mitigation strategies are discussed, emphasizing defense-in-depth.

11/6/2017

This post details Cloudflare's use of LavaRand, a system that leverages lava lamps as a secondary source of cryptographic randomness for its production servers. A camera captures the unpredictable flow of lava lamps in the San Francisco office lobby, and this video feed is fed into a CSPRNG to generate a stream of random values. This serves as a hedge against potential flaws in the primary sources of randomness used by the servers. The post explains the importance of unpredictable randomness in cryptography and how CSPRNGs work, drawing parallels to the physical world's inherent unpredictability.

9/14/2017

This post discusses the ongoing research and development in post-quantum cryptography (PQC) and the practical applications of computing on encrypted data. It highlights the need for PQC due to the potential threat of quantum computers breaking current encryption algorithms like RSA. The discussion also touches upon the feasibility of computing on encrypted data for machine learning and other applications, with potential for new functionalities in areas like medical research and financial services. The post mentions the NIST call for proposals for quantum-resistant algorithms and the ongoing efforts to integrate both classical and quantum-resistant key exchange methods. It also briefly touches on lattice-based cryptography as a promising area for PQC.

9/1/2017

This post details the implementation of Supersingular Isogeny Diffie-Hellman (SIDH) in Go for quantum-resistant TLS 1.3 key agreement. It explains the quantum threat to current cryptography, the mechanics of Diffie-Hellman key agreement in TLS 1.3, and the principles of SIDH. The implementation leverages a Go package 'p751sidh' with an inner 'p751toolbox' for low-level finite field arithmetic, ported from Microsoft Research's C and assembly implementation. The post highlights the performance challenges of field arithmetic in Go and the use of assembly for optimization, as well as the hybrid approach combining X25519 and SIDH for TLS 1.3.

12/22/2015

This post details the practical implications of SHA-1's cryptographic weaknesses, explaining that while SHA-1 collisions are becoming feasible, forging a digital certificate requires more than just a collision. It highlights the 'chosen-prefix attack' technique used to forge an MD5 certificate in the past, which relies on predictable certificate fields like serial numbers and validity periods. The post emphasizes that by including randomness in certificate serial numbers, Certificate Authorities can significantly increase the difficulty of such attacks, even when hash collisions are possible.

7/10/2014

Introduced CFSSL, an open-source toolkit for TLS/SSL certificate management and internal Certificate Authority infrastructure. CFSSL simplifies certificate bundling by selecting optimal certificate chains for compatibility, security, and performance. It can be used as a command-line tool or a web service with a JSON API.

1/6/2014

This post provides a technical primer on backdoors in cryptographic algorithms, specifically focusing on the Dual_EC_DRBG pseudo-random number generator. It explains the concept of backdoors, how they can be inserted (software, hardware, algorithm design), and the dangers of using a compromised random number generator. It details the construction of a standard pseudo-random number generator using hash functions and then introduces elliptic curves as a mechanism for creating one-way functions, which can be leveraged to build a compromised random number generator by using two specific points (P1 and P2) and a secret number 'n' to generate predictable outputs.

10/24/2013

This post provides a foundational explanation of Elliptic Curve Cryptography (ECC) as a more secure and performant alternative to RSA. It details the mathematical underpinnings of public-key cryptography, explains RSA with a toy example, and highlights the limitations of RSA due to the efficiency of factoring algorithms. It then introduces elliptic curves as a basis for a better trapdoor function, explaining their mathematical definition and graphical representation.

10/3/2013

This post details the inner workings of Linux's random number generator, focusing on the kernel entropy pool, entropy sources (timestamps from user interaction, network, disk), and how XOR is used to mix entropy. It explains the difference between /dev/random (blocking) and /dev/urandom (non-blocking) when entropy levels are low, and how cryptographic hash functions like SHA-1 are used to derive high-entropy random numbers from the pool. It emphasizes the importance of monitoring entropy availability.

9/20/2013

This post explains the difference in key lengths between symmetric and asymmetric cryptography, specifically in the context of TLS connections. It details why symmetric keys (like AES) can be shorter (e.g., 128-bit or 256-bit) due to the vast number of possible keys, making brute-force attacks impractical. In contrast, asymmetric keys (like RSA) require much larger key lengths (e.g., 2048-bit) because their security relies on mathematical problems (like prime factorization) which have fewer possible solutions and are susceptible to specific algorithmic attacks (e.g., General Number Field Sieve). The post uses examples of RC4, AES, ECDHE_RSA, and RSA to illustrate these concepts.

9/13/2013

This post explains the critical role of good random numbers in secure systems, using the example of a Hacker News session ID vulnerability. It details how a weak pseudo-random number generator (PRNG) seeded with time allowed an attacker to predict session IDs. The post contrasts the middle-square method with cryptographically secure PRNGs (CSPRNGs) and highlights the importance of proper seeding. It also explains how random numbers are used in SSL/TLS and WPA2. Cloudflare's current random number sources (OpenSSL, Linux kernel) are mentioned, and the company's project to add a source of truly random numbers (from physical processes) is introduced to further improve security.