Cloudflare Implements Automatic Post-Quantum Key Exchange

• •Cloudflare's Automatic Key Exchange boosts post-quantum traffic to 45 billion connections daily.
• •TLS handshake delays reduced significantly, with HelloRetryRequest occurrences dropping to 3.7%.
• •Feature prioritizes post-quantum algorithms while maintaining compatibility with classical ones.

Cloudflare has launched an Automatic Key Exchange feature that selects post-quantum key exchange algorithms for TLS 1.3 connections to compatible origin servers. This enhancement has led to a significant increase in protected traffic, reaching 45 billion connections per day, while reducing TLS handshake delays. The feature prioritizes the hybrid post-quantum algorithm X25519MLKEM768 and falls back to classical algorithms when necessary. Previously, clients had to send a key before the server indicated its preference, which often resulted in retries and increased latency. With the new capability, the proportion of connections requiring a HelloRetryRequest has decreased from 52% to 3.7%. Cloudflare's proactive scanning and daily rescans ensure that connection failures are minimized. The deployment is enabled by default for new and existing Cloudflare domains that support TLS 1.3, with ongoing efforts for more granular control and detection methods.