Cloudflare maps a post-quantum future for Privacy Pass with issuer-hiding MOLE credentials

Cloudflare has set out how it expects web privacy infrastructure to cope with cryptographically relevant quantum computers. In a blog post, the company argues that the post-quantum transition reaches well beyond TLS to protocols such as Privacy Pass, and sketches a successor framework, MOLE, meant to carry anonymous credentials into a quantum-safe future.

The quantum threat to Privacy Pass

According to the Cloudflare blog, the top priority of the migration is replacing the basic building blocks of authenticated key agreement in protocols such as TLS; without them, secure communication on the Internet will not be possible once capable quantum computers arrive. But the web relies on quantum-vulnerable cryptography for far more than TLS. Privacy Pass, which site operators including Cloudflare use to protect applications from abuse, still depends on classical schemes such as RSA and elliptic curves.

The impact of a quantum attacker splits in an unusual way. Cloudflare says forgery breaks: a quantum computer could mint unlimited Privacy Pass tokens and use them to sidestep rate limiting and other protections an operator has put in place. Privacy, however, survives. The company describes Privacy Pass as unconditionally private, meaning no attacker, quantum or not, can connect the redemption of a token to its issuance, and it says the next generation of the technology will uphold the same guarantee.

What Privacy Pass does today

Privacy Pass issues clients tokens they can redeem for access to a site, avoiding the usual trade-off between friction, such as CAPTCHAs and other challenges, and privacy, such as accounts and fingerprinting. Cloudflare cites ten years of deployment experience, including privacy proxies like iCloud Private Relay and relays like Privacy Gateway, and says it is collaborating with others on a successor. Two goals stand out: better tools for managing agentic traffic that would otherwise drain resources and slow things down for human visitors, and a more open ecosystem that lets more kinds of clients take part.

Inside MOLE

That successor is currently called MOLE, short for Moderation Of unLinkable Endorsements. A Privacy Pass token today consists of a message plus a blindly issued signature, and verifying it requires the issuer's public key, so the verifier learns which issuer stands behind the token even though the client stays anonymous. Cloudflare notes that issuer identity is genuinely useful in some cases, for example proving a client is authorized to use a customer's VPN, but often a site only needs to know that some trusted entity issued the token.

MOLE removes that leakage. Its core object, the endorsement, is issued by an anchor and redeemed by a moderator. Before redemption, the client and moderator agree on an anchor set, the public keys of the anchors the moderator trusts, and the client proves it holds an endorsement from one of them without revealing which. On acceptance, the moderator issues a MOLE credential that governs the client's interaction with the site. Hiding the issuer entirely also means tokens cannot be treated differently based on who issued them, which Cloudflare argues makes it easier for more clients to participate. Credentials themselves can take many forms, from blind signatures to anonymous credit tokens or anonymous rate-limited credentials, and, being bound to a particular moderator, need not hide anchors or be publicly verifiable.

The size problem

The main obstacle is the one familiar from TLS: post-quantum primitives are large. Cloudflare points out that an ML-DSA-44 signature runs to 2,420 bytes while an ECDSA-P256 signature is 64 bytes, and it sees little hope of like-for-like replacements arriving soon. Systems will have to settle for costlier primitives and be re-engineered to bear the cost. The company also credits a recent breakthrough in blind signature design with making this post-quantum path plausible at all.

Adaptability versus efficiency

Cloudflare frames the deeper challenge as decoupling parameter selection from protocol design. ML-DSA, it notes, comes from a larger family of constructions whose parameters were tuned to produce a compact signature scheme; those same parameters would not necessarily be secure for other uses. MOLE cannot afford that rigidity, because it must support many credential types that will keep changing alongside new traffic patterns and attacker behavior. Classical credential systems got this flexibility for free, since designers rarely had to think about their elliptic-curve parameters, and reproducing it with post-quantum tools is, in Cloudflare's telling, the central problem for anonymous credentials.

Why it matters

Even a prompt TLS migration would leave the rest of the web's defenses exposed: rate limiting, bot mitigation and anonymous-access schemes quietly rest on signatures a quantum computer could forge. Cloudflare's post is a reminder that quantum readiness is a whole-stack effort, and that the fixes will come as bigger payloads and redesigned protocols rather than painless swaps. MOLE also signals where web access control is heading: credentials that hide not just the user but the issuer, treating browsers, humans and AI agents alike just as operators search for ways to manage automated traffic.