Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)
Cloudflare's Automatic Key Exchange probes origins to lead with preferred key exchange, cutting HelloRetryRequests from 52% to 3.7% and enabling automatic post-quantum origin connections.
Cloudflare announced Automatic Key Exchange, an extension of Automatic SSL/TLS that probes each origin's supported key agreement algorithms and leads with the preferred one, favoring the post-quantum hybrid X25519MLKEM768. Rollover across roughly 45 billion daily origin connections cut HelloRetryRequests from about 52% to 3.7%, saving more than 150 ms of p90 handshake latency. Hundreds of thousands of domains now receive post-quantum origin connections without manual configuration, supporting Cloudflare's goal of quantum-safe encryption by 2029 to counter harvest-now-decrypt-later attacks.
- Probing replaces static X25519 guessing, preferring post-quantum X25519MLKEM768 where supported
- HelloRetryRequests fell from ~52% to 3.7%, cutting over 150 ms at p90
- Hundreds of thousands of domains now use post-quantum origin connections by default
- Aims to mitigate harvest-now-decrypt-later risk ahead of estimated Q-Day around 2029
From the original article
13 min read at blog.cloudflare.com
Automatic Key Exchange probes TLS 1. 3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it.
By Suleman Ahmad · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.