Cloudflare automates post-quantum key exchange for 45 billion daily origin connections

Cloudflare swaps TLS guesswork for per-origin measurement

Cloudflare has announced Automatic Key Exchange, an extension of its Automatic SSL/TLS system that changes how the company negotiates encryption with the origin servers sitting behind its reverse proxy. According to the Cloudflare blog, the feature applies to roughly 45 billion daily connections and is rolling out now.

Because Cloudflare sits between visitors and origin servers, what looks like one secure connection is really two: one from the visitor to Cloudflare, and one from Cloudflare to the origin. Automatic Key Exchange affects the second half, where Cloudflare acts as the TLS client.

TLS 1.3 lets a client establish a connection in a single round trip, but only if it commits to a key agreement algorithm in its very first ClientHello message, before the server has said anything about what it supports. If the origin prefers a different algorithm, it sends a HelloRetryRequest and the handshake starts over, adding a full extra round trip. For years, Cloudflare's opening guess was always X25519, a classical elliptic-curve algorithm supported by more than 95% of origins. The company has since measured that this static choice was the wrong opening move for about 30% of origin connections.

Automatic Key Exchange replaces the guess with measurement: Cloudflare probes each origin to learn exactly which key agreement algorithms it supports and prefers, then leads with that algorithm on the first attempt, favoring the post-quantum hybrid X25519MLKEM768 wherever the origin can handle it. According to the post, the share of connections needing a retry fell from roughly 52% to 3.7%, trimming more than 150 milliseconds from handshake latency at the 90th percentile.

Why post-quantum was stuck behind a retry

X25519, while widely supported, can be broken by a sufficiently capable quantum computer. Cloudflare has advertised post-quantum key agreement to origins since September 2023, first as X25519Kyber768Draft00 and later as the standardized X25519MLKEM768. But advertising support is not the same as actually sending a post-quantum keyshare up front.

The reason is size. An X25519MLKEM768 keyshare weighs 1,216 bytes versus 32 bytes for X25519, which pushes the ClientHello past a single network packet. Some legacy middleboxes and origin servers fail when a ClientHello spans multiple packets: in an earlier Cloudflare study, about 0.34% of scanned origins could not complete a handshake when offered a post-quantum keyshare first. So Cloudflare kept the retry mechanism as a fallback, opening with classical X25519 and letting capable origins request the upgrade. Customers who wanted post-quantum first could opt in manually.

That safety carried a cost. Origin support for post-quantum algorithms has grown from 0.5% in 2023 to 12.8% today, and modern builds of OpenSSL, BoringSSL and rustls increasingly respond to a classical X25519 keyshare by demanding a retry so they can prioritize post-quantum encryption. Separately, over 6% of origins prefer P-256 or P-384 over X25519, which triggered retries even for purely classical connections.

How the probing works

Rather than infer capability, Cloudflare measures it directly, reusing the scanning pipeline that already powers Automatic SSL/TLS. For each TLS 1.3-capable origin, it runs a handful of lightweight handshakes, each offering exactly one key agreement group — X25519, P-256, P-384, P-521 or X25519MLKEM768 — to determine the full range of algorithms the origin accepts. The initial keyshare is then tailored per origin, which Cloudflare says maximizes post-quantum use while avoiding breakage.

The company reports that hundreds of thousands of domains now have post-quantum origin connections that nobody had to configure, a count that keeps climbing. Before this change, preferring post-quantum connections required a manual setting on either Cloudflare's side or the origin server's, and the post notes it was easy to get wrong.

Why it matters

The immediate win is latency, but the larger one is cryptographic. An adversary recording encrypted traffic today could decrypt it later once quantum computers mature — the "harvest now, decrypt later" attack. Cloudflare says it is working to make the Internet quantum-secure by 2029, the year some industry experts estimate classical algorithms could be breached, a date nicknamed Q-Day. Meeting that deadline, the company argues, cannot depend on millions of website operators becoming cryptographers; the defaults themselves have to change. Automatic Key Exchange is a concrete step in that direction: post-quantum protection delivered by measurement and default rather than by configuration, across tens of billions of connections a day.