# Cloudflare commits to full post-quantum security by 2029!

Hey everyone, it's Shii-chan! Today I've got a slightly heart-pounding story about the future of cryptography getting pulled way forward.

## What was announced?

On Cloudflare's Blog, they shared an accelerated roadmap: the goal is now to be fully post-quantum (PQ) secure by 2029. The biggest point is that it's not just the "encryption" they've been working on -- they're committing to post-quantum **authentication** too.

Cloudflare handed out free [Universal SSL](https://blog.cloudflare.com/introducing-universal-ssl/) back in 2014, began preparing its post-quantum migration in 2019, and [enabled post-quantum encryption for all websites and APIs](https://blog.cloudflare.com/post-quantum-for-all/) in 2022. Today [over 65% of human traffic to Cloudflare](https://radar.cloudflare.com/post-quantum) is post-quantum encrypted. Amazing, right!

## Why it matters

The trigger is a burst of recent progress in quantum computing. Last week Google [announced](https://research.google/blog/safeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly/) a big improvement to the quantum algorithm for breaking elliptic curve cryptography. On the same day, Oratomic published a resource estimate for breaking RSA-2048 and P-256 on a neutral atom quantum computer. And for P-256...

> For P-256, it only requires a shockingly low 10,000 qubits.

Just 10,000 qubits -- a stunning number. What was assumed to be a "Q-Day is 2035 or later" story has suddenly gotten much closer. That's why Cloudflare says it's also moving up its internal Q-Day readiness timeline.

## What changes

The biggest shift is that what needs protecting expands from "encryption" to "authentication." Let me lay it out my own way.

- **Attacks on encryption**: collect ciphertext now and decrypt it later with a future quantum computer -- "harvest-now / decrypt-later." PQ encryption already closes off most of this.
- **Attacks on authentication**: an attacker with a working quantum computer impersonates servers or forges access credentials. If Q-Day is far off, there's no rush -- but if Q-Day is near, the script flips.

Cloudflare's own settings are on by default, with no switches to flip. But the post honestly notes that **the other side -- browsers, apps, and origin servers -- has to upgrade, and that's not something Cloudflare controls**. For corporate networks, [Cloudflare One provides end-to-end post-quantum protection](https://blog.cloudflare.com/post-quantum-sase/) when tunneling traffic, so you're covered there.

## Dive Deep

Making authentication post-quantum is actually trickier than encryption. Just "adding" post-quantum methods isn't enough -- you have to **disable** the old quantum-vulnerable crypto, or you can't stop downgrade attacks. But on the web, where all kinds of clients mix together, some browsers still won't support post-quantum certificates, so servers have to keep supporting the old methods. That's the hard part.

As a fix, the article points to downgrade protection for HTTPS using "PQ HSTS" and certificate transparency. And even after you disable the old methods, any secrets that were exposed under them -- passwords, access tokens -- need to be rotated.

The prioritization is pragmatic. Early quantum computers will be scarce and expensive, so attackers will go after high-value targets: **long-lived keys** like root certificates, API auth keys, and code-signing certs. Once such a key is stolen, an attacker keeps using it until it's revoked.

And this protection comes, as Cloudflare has long said, at [no additional cost](https://blog.cloudflare.com/post-quantum-crypto-should-be-free/). The technical details are collected in the [post-quantum cryptography developer docs](https://developers.cloudflare.com/ssl/post-quantum-cryptography/).

## Wrap-up

- Cloudflare pulled its goal of full post-quantum security (including authentication) forward to 2029
- The trigger: Google's improved elliptic-curve attack algorithm and Oratomic's estimate that P-256 can be broken with 10,000 qubits
- What needs protecting expands from "encryption (harvest-now / decrypt-later)" to "authentication (impersonation and credential forgery)"
- Long-lived keys -- root certificates, API auth keys, code-signing certs -- come first
- Downgrade defense uses PQ HSTS and certificate transparency, at no extra cost

Now that Q-Day is no longer a "far-off future" story, this one really lands for infrastructure and security engineers who hold long-lived keys. It even made me want to take a fresh look at how long my own keys live.