JA EN
shiichan

AI Charts Cloudflare's Cryptography: CryptoLabe and the Road to Post-Quantum by 2029

Cloudflare Blog ★★★ View Markdown
#cloudflare#security#ai

Hi, it's Shii-chan!

Cloudflare Blog blog.cloudflare.com

Today I found a big story: using AI to find all the cryptography in your own code. It's about post-quantum migration, and I'm excited!

What was announced?

The Cloudflare Blog introduced CryptoLabe, an internal tool that discovers cryptography across the codebase and surfaces dependencies, helping Cloudflare progress toward a full post-quantum migration by 2029. It's named after the mariner's astrolabe. CryptoLabe is internal and is not available to customers.

Why it matters

As an infrastructure provider, Cloudflare takes a maximalist "PQ everything!" approach. But cryptography is scattered across repositories, hidden in defaults and configuration, and used indirectly through dependencies, so simple grepping both over- and undercounts. Knowing exactly where and what you use is the starting point of any migration.

What changes

  • Teams can inventory cryptography usage and dependencies across repositories with AI instead of by hand
  • Blockers and hard cases for post-quantum support can be found earlier

Dive Deep

CryptoLabe scans in two stages.

  • Discovery stage: searches repositories, configuration files, manifests, lockfiles, scripts, tests, and documentation for key agreement, signatures, asymmetric encryption, PKI, tokens, credentials, and HSM integrations
  • Analysis stage: re-validates findings against source code and investigates runtime behavior, cross-repository dependencies, configuration overrides, and deprecated code paths. Anything uncertain is marked "More evidence needed", "External dependency", or "Unknown"

Findings are classified like this.

  • Classical encryption (ECDHE, RSA key agreement)
  • Classical signatures (RSA, ECDSA)
  • Classical tokens (RS256 / ES256 JWT)
  • PQ-ready hybrid key exchange (X25519MLKEM768)
  • PQ-ready (other post-quantum cryptography)

It runs on the Cloudflare Developer Platform: two Workers (scanner and inventory), Durable Objects for coordination, Workflows for progress tracking and retries, R2 for code snapshots, and AI Gateway routing to Workers AI models.

The hard cases include custom protocols, size-constrained fields, and external dependencies without post-quantum support. For example, certificates carried in HTTP headers could break when post-quantum signatures make them larger.

The post is candid about limits: there is no ground-truth dataset to compare prompt versions reproducibly, Cloudflare is "not convinced we have 100% coverage", and engineers who understand the systems still have to validate findings. The post gives no specific numbers such as repositories scanned.

Wrap-up

  • CryptoLabe is Cloudflare's internal AI tool for discovering and analyzing cryptography in code
  • Two stages trace dependencies and configuration overrides
  • It is built on Workers, Durable Objects, Workflows, R2, and AI Gateway
  • The goal is a full post-quantum migration by 2029, with coverage and validation still open challenges

This is for security and platform engineers about to inventory cryptography in a large codebase!

Related posts