Research & Development Approach

9 posts · Sep 2019 – Feb 2022

What this trail covers

Cloudflare's research and development approach has evolved from a specialized Cryptography Research team to a broader Cloudflare Research initiative, driven by a hybrid model that embeds research engineers into product and operations teams for temporary assignments. This provides direct exposure to practical problems and leverages production data for experiments. The team also collaborates with industry and academia, focusing on impact-driven projects and open collaboration through public outreach, standardization, and large-scale implementation. This approach is applied to long-term projects like migrating the Internet to secure network protocols, and emerging areas like post-quantum cryptography and secure time synchronization.

All Cloudflare trails

Feb 2022Building Confidence in Cryptographic ProtocolsThis post introduces the concept of formal analysis and mathematical proofs for cryptographic protocols, using KEMTLS as an example. It details how process algebras and tools like Tamarin are used to model protocols, simulate runs, and build confidence in their security, especially in the context of post-quantum cryptography. This demonstrates a deep dive into the rigorous, research-driven approach to ensuring the security of core technologies.
Feb 2022Using EasyCrypt and Jasmin for post-quantum verificationThis post introduces Cloudflare's application of formal verification and analysis techniques, specifically using EasyCrypt and Jasmin, to ensure the correctness and security of cryptographic implementations, particularly in the context of post-quantum cryptography. It details the goals of such processes, which include proving algorithm security properties and verifying implementation correctness, memory safety, and constant-time execution. The post also contrasts computational analysis (used by EasyCrypt) with symbolic analysis (used by Tamarin) and explains the 'indistinguishability game' as a model for cryptographic security.
Feb 2022Deep dive into a post-quantum key encapsulation algorithmThis post delves into the foundational mathematics and algorithmic construction of post-quantum key encapsulation mechanisms (KEMs), specifically focusing on FrodoKEM. It explains the necessity of post-quantum cryptography due to the threat of quantum computers to current encryption standards, introduces the concept of KEMs and their three core algorithms (Generate, Encapsulate, Decapsulate), and details the Learning With Errors (LWE) problem as the mathematical basis for FrodoKEM's security. It also touches upon the relationship between LWE and lattice-based cryptography.
Nov 2021How we build software at CloudflareThis post details Cloudflare's pragmatic approach to software delivery, emphasizing team autonomy in choosing methodologies (Waterfall, Agile variants) while establishing common high-level concepts like "SHIPs" and "EPICs" for transparency and collaboration. It outlines a quarterly planning process, continuous delivery, and flexible target dates, all underpinned by strict, simple rules for code deployment to ensure safety and minimize friction. This contributes to the broader R&D approach by defining how ideas are brought to fruition and integrated into products.
Oct 2021Pairings in CIRCLThis post announces a major update to the open-source CIRCL cryptographic library, including new packages for pairing-based cryptography and quantum-resistant algorithms. It highlights how this work builds on previous research experiments and product integrations, demonstrating the practical application of cutting-edge cryptographic research within Cloudflare's product development, specifically mentioning applications like identity-based encryption, zk-SNARKS, and drand.
Advertisement
Oct 2021Cloudflare Research: Two Years InThis post details the evolution of Cloudflare Research over its first two years, outlining five operating principles: innovation from all places, a question-oriented approach, building tools for future issues, and fostering collaboration. It highlights three case studies: privacy-preserving password security (involving support engineering, external experts, and WAF integration), SSL/TLS recommender (using scanning/crawling tools to improve security posture), and IP address agility (experimenting with serving free customers from a single IP in a region to challenge assumptions about IP-to-server mapping). The post emphasizes the full-stack nature of research engineering, from conception to production code, and the importance of embedding researchers within product and engineering teams.
Sep 2019Cloudflare’s Approach to ResearchThis post announces the expansion of Cloudflare's Cryptography Research team into Cloudflare Research, broadening its scope to include more areas of computer science research. It details the hybrid research model, emphasizing embedding research engineers into product/operations teams for temporary assignments to tackle practical problems and leverage production data. The post highlights an impact-focused philosophy, prioritizing projects with significant potential and insufficient existing solutions. It also emphasizes open collaboration through public outreach, standardization efforts, and open-sourcing code. Examples of past research-driven projects are provided, including work on TLS 1.3, Certificate Transparency, and NTS/Roughtime.