Post-quantum encryption for Cloudflare IPsec is finally GA!

Hey everyone, it's Shiichan! Today's story is a little peek into the future of cryptography. Let's quietly protect our important traffic before quantum computers show up. So exciting!

Cloudflare Blog blog.cloudflare.com

What was announced?

From the Cloudflare Blog. Post-quantum encryption for Cloudflare IPsec is now generally available (GA)! It graduated from closed beta, so hybrid ML-KEM now works in production, and it has been confirmed to interoperate with Cisco and Fortinet gear too.

The story so far

Web traffic (TLS) is pretty far along already: more than two-thirds of human-generated traffic to Cloudflare is protected by post-quantum cryptography. But IPsec, the backbone of many VPNs, was standardized about four years behind TLS, and on Cloudflare it was still in closed beta.

Why the hurry? Because of harvest-now-decrypt-later attacks, where someone collects your ciphertext today and decrypts it once quantum computers are strong enough. Even if it can't be read now, sensitive data you need to keep for years has to be protected today.

What changes

Now, when you connect sites and cloud VPCs through Magic WAN or the Cloudflare One SASE platform, your production IPsec tunnels are protected with hybrid ML-KEM. Data centers, branch offices, and clouds all get a key exchange built for the quantum era. And Cloudflare plans to offer this post-quantum encryption at no extra cost, so it's gentle on your budget too.

Dive Deep

The design is hybrid. First a classical Diffie-Hellman exchange runs, then its key encrypts a second exchange running ML-KEM, and the outputs of both are mixed into the session keys. That way, if one is broken, the other still holds. The resulting keys protect the actual data traffic via ESP (Encapsulating Security Payload).

ML-KEM is a lattice-based key-encapsulation mechanism, and the original describes it like this:

mathematical assumptions that are not known to be vulnerable to attacks by quantum computers

The standards behind it are NIST FIPS 203 and draft-ietf-ipsecme-ikev2-mlkem.

For interop, the Cisco 8000 Series works from 26.1.1 onward and Fortinet FortiOS from 7.6.6 onward. However, Palo Alto Networks' RFC 9370 implementation was built before standardization, so it doesn't interoperate yet. This GA is one step in Cloudflare's roadmap toward full post-quantum security by 2029.

Wrap-up

• Post-quantum encryption for Cloudflare IPsec went from closed beta to GA
• A hybrid key exchange combining classical Diffie-Hellman and ML-KEM guards against harvest-now-decrypt-later attacks
• Interop confirmed with Cisco 8000 (26.1.1+) and FortiOS (7.6.6+); Palo Alto's RFC 9370 implementation isn't supported yet
• Built on FIPS 203 and draft-ietf-ipsecme-ikev2-mlkem, offered at no extra cost

This one is for anyone running site-to-site VPNs on Magic WAN or Cloudflare One, and for security folks guarding data that has to stay secret for years!