Writer: Jordan Sprogis
Editor: Lillian Castro
Reviewer: Cristian Lopez
Key Takeaways
- Cloudflare unveiled new full-platform PQC protections that are designed to future-proof encrypted traffic as quantum computing evolves.
- Cloudflare uses a hybrid approach that allows for gradual PQC adoption without breaking client sites or requiring costly infrastructure overhauls.
- With NIST standards finalized and the NSA mandating quantum-safe algorithms, providers that act now can avoid rushed migrations when the dreaded (but inevitable) Q-Day comes.
Cloudflare has deployed post-quantum cryptography (PQC) protections across its entire platform, with more than 35% of its non-bot HTTPS traffic already protected, according to Infosecurity Magazine.
Cloudflare’s rollout is a milestone in securing the internet’s future and sends a clear message: Quantum-safe encryption is not far off in the distance; it’s going to quickly become a present-day expectation.
The company announced the upgrade in March and showcased it at Infosec Europe in June. In the official announcement, Matthew Prince, co-founder and CEO at Cloudflare, said:
“We want every Cloudflare customer to have a clear path to quantum safety, and we are already working with some of the most innovative banks, ISPs, and governments around the world as they begin their journeys to quantum security. We will continue to make advanced cryptography accessible to everyone, at no cost, in all of our products.”
The update addresses a threat model known as “store-now, decrypt-later,” where attackers collect encrypted data today in the hope that future quantum computers will be able to decrypt it.
Trey Guinn, Field CTO at Cloudflare, said that quantum attacks will sneak up on us faster than most will expect:
“The danger isn’t hypothetical — and it’s not many years in the future. In fact, criminals are already harvesting encrypted data today, betting that future quantum computers will be able to decrypt it.”
Quantum computers, which are still in their early stages, are expected to eventually break widely used encryption methods like RSA and ECC.
As to when, it’s a bit fuzzy: A Global Risk Institute Report found that there’s a 1 in 3 chance that Q-Day happens before 2035.
Meanwhile, Tom Patterson, a security lead at Accenture, said, “The world has five years to replace vulnerable cryptography with post-quantum solutions.”
How Cloudflare’s PQC Upgrade Works
Cloudflare uses a hybrid cryptographic model, which combines classical algorithms with post-quantum algorithms during the TLS handshake.
It’s simple: If a quantum attack occurs, the PCQ algorithms go to work. If there is another type of attack, the traditional algorithms function as usual.
Cloudflare has currently enabled PQC protections between its edge network and origin servers, where it controls both ends of the connection.
But it plans to expand protections to client-to-edge traffic, which relies on Kyber for key exchange and Dilithium for digital signatures.
These are both lattice-based algorithms hand-picked by the National Institute of Standards and Technology (NIST) for their resistance to quantum attacks.
Industry Adoption Is Growing
Cloudflare isn’t alone in prepping for Q-Day or its accompanying long-term threats:
- AWS has contributed to post-quantum key exchange and signature schemes, and it provides guidance for organizations developing their own migration plans.
- Google Cloud has also begun integrating NIST-approved PQC standards into its infrastructure, including its Cloud Key Management Service.
The U.S. National Security Agency (NSA) is also requiring quantum-safe algorithms for national security systems starting this year.
Additionally, NIST finalized the first post-quantum cryptographic standards in August 2024:
| Standard | What It Replaces | Based On | Use Case |
| ML-KEM | RSA/DH key exchange | CRYSTALS-Kyber | TLS handshakes, VPNs |
| ML-DSA | RSA/ECDSA signatures | CRYSTALS-Dilithium | Code signing, SSL certs |
| SLH-DSA | RSA/ECDSA | SPHINCS+ (hash-based) | Resource-constrained or high-assurance systems |
What Hosting Providers Should Do Now
So far, PQC adoption has largely been limited to high-risk, compliance-heavy industries like finance, defense, and healthcare.
But hosting providers will absolutely face pressure to implement stronger protections as quantum threats become more prevalent in other industries.
Thankfully, Cloudflare offers a clear blueprint. Plus, its use of hybrid cryptography allows for slow adoption without disruption.
That’s a major win for shared hosts, where compatibility issues are common and infrastructure overhauls are usually not in budget.
This upgrade lets hosting providers modernize their security posture without breaking sites, forcing upgrades, or losing clients who are still relying on older systems.
As for those not using Cloudflare, hosts can still join in if they:
- Audit their current SSL/TLS setup
- Double-check how well it works with NIST-approved PQC algorithms
- Stay up-to-date on the evolving standards for PQC
By preparing now, providers can avoid rushed migrations later. It’s the classic “work now, play later” mentality. Except when quantum threats hit, those who didn’t will wish they had.
