Cloudflare outlines a post-quantum path for Privacy Pass
Original title: The post-quantum future of web privacy
A quantum attacker could forge today’s Privacy Pass tokens, while token privacy is described as holding even after Q-day.
Cloudflare says Privacy Pass still uses RSA and elliptic curves, so a cryptographically relevant quantum computer could forge tokens and bypass rate limits and similar controls. The protocol’s privacy is described as unconditional: redemption cannot be linked to issuance by a quantum attacker either. Cloudflare and collaborators are designing MOLE, which uses endorsements and issuer-hiding proofs so moderators cannot tell which trusted anchor issued a token. The post says post-quantum signatures such as ML-DSA-44 are far larger than ECDSA-P256, so systems must be re-engineered rather than swapped in place.
Unconfirmed: MOLE and the post-quantum primitives are a proposed design, not a deployed replacement.
- Privacy Pass tokens are used for proxies such as iCloud Private Relay and Privacy Gateway.
- ML-DSA-44 signatures are 2,420 bytes versus 64 bytes for ECDSA-P256.
- MOLE hides which anchor in an agreed set issued an endorsement.
- Goals include moderating agentic traffic and letting more client types participate.
- Vendors
- Cloudflare
- Products
- Privacy PassMOLE
From the original article
14 min read at blog.cloudflare.com
Cryptographic protocols like Privacy Pass help keep web sites safe from abuse while keeping their users private. This post looks at the quantum threat to these protocols, and some new post-quantum cryptography that may help close the gap.
By Christopher Patton · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.