techlist.io
KR EN
cloudflare

Post-quantum authentication to origins is now supported (opens in new tab)

cloudflarepost-quantum-cryptographyml-dsaopensslpkimutual-tlsauthenticated-origin-pullscustom-origin-trust-store

Cloudflare has added post-quantum authentication to Authenticated Origin Pulls (AOP) and Custom Origin Trust Store (COTS), enabling fully post-quantum-secure mutual TLS between Cloudflare and customer origins. The implementation uses ML-DSA signatures, with ML-DSA-44 recommended for most deployments. This marks the first milestone in Cloudflare’s roadmap toward full post-quantum security by 2029.

Why Cloudflare-to-Origin Authentication Is Different

  • A proxied request typically involves:
    • Visitor to Cloudflare
    • Cloudflare to the customer’s origin
  • Post-quantum encryption already protects both connections.
  • Authentication requirements differ for the origin connection because:
    • Cloudflare controls the client side and can use connection pooling to amortize signature costs.
    • Cloudflare and customers already have an account-based trust relationship.
    • Custom PKIs can be used without relying on public WebPKI constraints such as intermediate certificates and Certificate Transparency.
  • Cloudflare is pursuing Merkle Tree Certificates for visitor-to-Cloudflare authentication, but ML-DSA can be deployed sooner for origin connections.

ML-DSA Support

  • Cloudflare supports all FIPS 204 ML-DSA parameter sets:
    • ML-DSA-44
    • ML-DSA-65
    • ML-DSA-87
  • ML-DSA-44 is recommended for most applications because it offers the best performance while providing NIST category 2 security strength.

Custom Origin Trust Store

  • In Full (strict) SSL mode, Cloudflare validates origin certificates against trusted public CAs and Cloudflare’s Origin CA.
  • COTS lets customers replace that default trust store with a set of customer-controlled CAs.
  • Customers can now upload ML-DSA CAs.
  • Cloudflare will trust origin certificates that chain to those ML-DSA CAs.
  • COTS requires Advanced Certificate Manager.

Authenticated Origin Pulls

  • AOP enables mutual TLS, allowing origins to require requests to come from Cloudflare.
  • It is available on all Cloudflare plan levels.
  • Per-zone and per-hostname AOP configurations now support ML-DSA certificates and private keys.
  • Private keys must be uploaded in FIPS 204 seed format.
  • The global AOP configuration does not yet support this capability and will require additional work.

Preventing Downgrade Attacks

  • Simply supporting post-quantum algorithms is not enough if classical authentication methods remain trusted.
  • An attacker with the ability to forge classical credentials could force a connection to downgrade to a quantum-vulnerable mechanism.
  • Origins must therefore remove trust in classical authentication mechanisms where appropriate.
  • Cloudflare’s AOP and COTS configuration guidance explains how to prevent these downgrades.

Configuration Requirements

  • Certificate generation requires OpenSSL 3.5.0 or later.
  • ML-DSA private keys must use the FIPS 204 seed-only encoding.
  • Customers configure:
    • An ML-DSA CA and origin certificate chain for COTS
    • An ML-DSA client certificate and private key for AOP
  • Configuration can be performed through the Cloudflare API, with dashboard instructions available in the developer documentation.

Cloudflare customers needing post-quantum protection for origin connections should combine ML-DSA-based COTS and AOP, explicitly remove trust in classical alternatives, and use ML-DSA-44 unless their security requirements justify a larger parameter set.