Cloudflare stops guessing at post-quantum handshakes across 45 billion daily connections

Why it matters

Post-quantum migration will stall if every website operator must audit algorithms and middleboxes by hand. Cloudflare is using its network position to turn that work into a measured default while removing a round trip from compatible connections.

Cloudflare, the network and security provider co-founded by Matthew Prince (@eastdakota), launched Automatic Key Exchange on September 8th, a system that tests customer origin servers and selects the strongest key-agreement method they can handle before production traffic arrives.

The default-on feature addresses an expensive quirk in TLS 1.3. Cloudflare must propose a key-agreement algorithm in its first message to an origin, before that server has revealed its preferences. For years, Cloudflare sent the same initial choice, X25519, across its network. A mismatch triggers a HelloRetryRequest and adds another network round trip before Cloudflare can retrieve the requested content.

In its Automatic Key Exchange rollout report, Cloudflare says HelloRetryRequests fell from roughly 52% to 3.7% among scanned domains, cutting more than 150 milliseconds from handshake latency at the 90th percentile. Cloudflare's report says requests sent over existing keep-alive connections are unaffected because they do not require a new handshake.

For origins that support it, Cloudflare now prefers X25519MLKEM768, a hybrid exchange combining the established X25519 method with the post-quantum ML-KEM mechanism. Cloudflare says the rollout now covers roughly 45 billion daily origin-related connections.

The old Cloudflare argument, at a larger scale

The launch follows the operating thesis Prince, Michelle Zatlyn and Lee Holloway used to build Cloudflare in 2009: security infrastructure gains adoption when the provider absorbs the configuration work and controls the performance cost.

Cloudflare began after Prince and Holloway created Project Honey Pot to track how spammers collected email addresses. Zatlyn, who met Prince at Harvard Business School, saw an opportunity to turn those measurements into active website protection. Investors worried that placing Cloudflare between users and websites would slow the web, according to Cloudflare's account of its founding.

Automatic Key Exchange applies that playbook to a migration most website operators have little reason to understand in detail. Choosing post-quantum algorithms manually means knowing what the origin's TLS library, load balancer, firewall and other middleboxes support. A wrong enforcement setting can prevent every TLS 1.3 connection from completing.

Cloudflare instead probes each origin using lightweight handshakes before changing the production preference. It tests X25519, several classical elliptic curves and X25519MLKEM768, then uses the results to select the initial key-agreement preference for later connections. Cloudflare's technical documentation describes the system as measuring origin capabilities before changing the production preference.

Origins are rescanned daily, allowing a domain to move to post-quantum key exchange after a routine server or TLS-library upgrade. Automatic Key Exchange applies to qualifying TLS 1.3 origin connections.

The engineers turned a compatibility problem into a measurement problem

The launch was authored by senior research engineer Suleman Ahmad, Yawar Jamal and senior product manager Alex Krivit. Ahmad's Cloudflare Research profile identifies his work with Internet measurement, distributed systems, cryptography engineering, security and privacy.

Their caution reflects the messy state of real-world Internet infrastructure. A post-quantum X25519MLKEM768 key share is 1,216 bytes, compared with 32 bytes for X25519. That larger message can span multiple network packets. Cloudflare's earlier scanning found that about 0.34% of origins failed to complete a handshake when they received a post-quantum key share first, often because of legacy servers or middleboxes.

The rate is low, but it makes a universal forced migration risky. Cloudflare verifies compatibility before changing production traffic, then retains a classical exchange where the path cannot handle the hybrid algorithm.

Cloudflare says its rollout assigned preferences to well over one million domains: about 33% received X25519MLKEM768 and 64% remained on X25519. Cloudflare separately says hundreds of thousands of domains have made the transition to post-quantum origin connections.

Cloud providers are moving the default line

Cloudflare's differentiation is where the automation sits. Amazon CloudFront, Amazon's content-delivery network, supports hybrid post-quantum key exchange on client-to-edge connections through its TLS security policies. Those AWS materials describe viewer-to-edge support rather than automatic measurement of customer origin servers. Google Cloud Load Balancing supports post-quantum key exchange on frontend connections and plans to enable it by default in October 2026. Automatic Key Exchange targets the less visible second connection between Cloudflare's reverse proxy and a customer's origin server, using measurements of that origin rather than a single network-wide assumption.

The timing follows Cloudflare's broader commitment to make its products fully post-quantum secure by 2029, including authentication. Cryptographically relevant quantum computers do not exist today, but encrypted traffic collected now could be stored and decrypted later if classical public-key systems are broken. That makes key exchange an immediate migration problem for sensitive data with a long useful life.

Cloudflare has recently used its position in front of a large share of web traffic to make other security decisions centrally. RuntimeWire reported last week that Cloudflare launched OpenAI-powered vulnerability defense tied to live traffic, following an August rollout of a bot-detection engine that continuously retrains on network activity.

Automatic Key Exchange is a quieter infrastructure release with a cleaner bargain for customers: Cloudflare takes on the scanning, compatibility checks and cryptographic preference changes. The feature succeeds if those operators rarely need to open the settings page.