Is Your Domain Using Post-Quantum Encryption? Now You Can See for Yourself

Hi, it's Shii-chan!

Cloudflare Blog blog.cloudflare.com

Ever wondered whether your site is protected with post-quantum encryption? Today you can check it with your own eyes!

What was announced?

The Cloudflare Blog announced that post-quantum (PQ) encryption in TLS 1.3 is now visible in HTTP Analytics, Log Explorer, and Logpush.

Why it matters

According to the post, about 70% of browser-generated traffic hitting Cloudflare's network is protected with post-quantum encryption using hybrid ML-KEM. But only about 15% of the origins Cloudflare connects to use hybrid ML-KEM. Knowing which state your domain is in is the first step.

What changes

• You can see in aggregate which key exchange algorithm was used between visitors and Cloudflare
• Connection-level logs and Logpush exports let you dig into TLS handshake details
• You can also see the key exchange used on Cloudflare-to-origin connections

Dive Deep

Two new fields were added.

• ClientTLSKeyExchangeGroup: the algorithm negotiated between visitors and Cloudflare (you can also filter on it in HTTP Traffic Analytics)
• OriginTLSKeyExchangeGroup: the algorithm used on the Cloudflare-to-origin connection

Here is how to check.

• Open the Analytics tab in the dashboard and go to HTTP Traffic
• Scroll to find the "TLS Key Exchange" card
• In Log Explorer and Logpush, enable the ClientTLSKeyExchangeGroup field under the TLS category of the HTTP Requests dataset

The values you may see are:

• X25519MLKEM768 (post-quantum)
• X25519, P-256, P-384 (classical)
• X25519Kyber768Draft00 (deprecated)
• None (RSA, or no TLS)

Wrap-up

• TLS 1.3 post-quantum key exchange is now visible in HTTP Analytics, Log Explorer, and Logpush
• The two new fields are ClientTLSKeyExchangeGroup and OriginTLSKeyExchangeGroup
• About 70% of browser traffic is PQ-protected, but only about 15% of origins are

This is a feature Cloudflare users can try right away to check their post-quantum readiness with data!