JA EN
shiichan

Cloudflare's email is now fully quantum-resistant, and it upgraded itself automatically!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hi, it's Shii! Today I'm sharing something I found in Cloudflare's Changelog. It looks low-key, but it's actually a pretty important story for email security. Let's dive in!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced that Email Security's SMTP traffic now supports a key exchange method that stands up to quantum computers. Both the inbound MX connections used to receive mail and the outbound connections used to deliver it are covered.

Specifically, connections now use X25519MLKEM768, a hybrid key agreement, to establish TLS 1.3 sessions. When the other side (like Google Workspace) also supports the same method, the connection gets a post-quantum-resistant key exchange.

The story so far

Until now, SMTP traffic used TLS 1.3, but the key exchange part relied only on classical methods. Even though that's strong enough for today's computers, there's a concern called "harvest now, decrypt later": someone could intercept and store today's encrypted traffic, then decrypt it later once more powerful quantum computers exist. Email is often kept around for a long time, so it's actually a pretty attractive target for this kind of attack.

What changes

With this in place, email traffic going through Email Security gets automatically protected with tougher encryption whenever the other side also supports post-quantum key exchange. And the best part is you don't have to configure anything! It's enabled automatically for every customer, and it's backward compatible, so if the other side doesn't support it yet, you still connect normally using classical key exchange as before. No need to worry about mail suddenly failing to deliver.

Dive Deep

  • Covers all Email Security packages: Advantage, Enterprise, and Enterprise + PhishGuard
  • Protects both inbound MX connections and outbound delivery connections
  • The key exchange method is X25519MLKEM768, a hybrid combining classical X25519 with the post-quantum algorithm MLKEM768
  • Falls back to classical key exchange as before when the peer doesn't support it

Wrap-up

  • Cloudflare Email Security's SMTP traffic now supports X25519MLKEM768 hybrid key exchange
  • It covers both inbound (MX) and outbound (delivery) connections
  • No configuration needed, it's enabled automatically for all customers
  • Communication still works via backward compatibility even if the peer isn't ready yet
  • A great move for protecting long-lived email from "intercept now, decrypt later" attacks!

Related posts