Preventing Quantum Downgrade Attacks Against IPsec

Hi, it's Shii-chan!

Cloudflare Blog blog.cloudflare.com

Today's topic is a downgrade attack that can hit even post-quantum IPsec, and how to prevent it. It's a bit tricky, so I'll walk through it step by step!

What was announced?

The Cloudflare Blog described how to prevent quantum downgrade attacks against IPsec. Cloudflare worked with the IETF IPsec Maintenance Working Group to develop an extension called IKE_SA_INIT_FULL_TRANSCRIPT_AUTH.

Why it matters

A sophisticated attacker with a quantum computer can exploit a protocol design flaw to downgrade post-quantum IPsec tunnels to classical cryptography. The flaw has been documented for at least 10 years. Cloudflare moved its quantum transition deadline to 2029, so closing this gap matters.

What changes

• An on-path attacker can no longer make each side believe its peer lacks post-quantum support
• Downgrading would require forging signatures from both parties, a much higher bar
• It is available as an opt-in beta in Cloudflare WAN and Magic Transit

Dive Deep

Here is the flaw. In IPsec, each party only signs its own outbound messages, rather than the entire handshake transcript as in TLS 1.3. That lets an on-path attacker (Mallory in the post) create a split view, where the initiator and responder see different message sequences. Even when both sides support post-quantum methods, each can be led to believe the other does not, and the downgrade succeeds.

The extension authenticates the full transcript, like TLS 1.3. Both parties send an unconditional notification of support, regardless of whether the other party requests it. If the notifications mismatch, authentication fails. If an attacker drops both notifications to force a downgrade, they would need to forge signatures from both parties.

On status, the extension is on its way to RFC status. Cloudflare has implemented beta support in Cloudflare WAN and Magic Transit, opt-in through the ipsec_downgrade_protection flag, with general availability planned after testing.

Wrap-up

• IPsec parties sign only their own outbound messages, which leaves room for downgrade attacks
• IKE_SA_INIT_FULL_TRANSCRIPT_AUTH adds full handshake authentication to prevent them
• Unconditional notifications mean a downgrade requires forging both parties' signatures
• A beta is available in Cloudflare WAN and Magic Transit via ipsec_downgrade_protection, with GA after testing

This is for network engineers planning post-quantum migration of IPsec tunnels!