Post-quantum authentication to origins is now supported (opens in new tab)
Cloudflare has added post-quantum authentication to Authenticated Origin Pulls (AOP) and Custom Origin Trust Store (COTS), enabling fully post-quantum-secure mutual TLS between Cloudflare and customer origins. The implementation uses ML-DSA signatures, with ML-DSA-44 recommended for most deployments. This marks the first milestone in Cloudflare’s roadmap toward full post-quantum security by 2029. ## Why Cloudflare-to-Origin Authentication Is Different - A proxied request typically involves: - Visitor to Cloudflare - Cloudflare to the customer’s origin - Post-quantum encryption already protects both connections. - Authentication requirements differ for the origin connection because: - Cloudflare controls the client side and can use connection pooling to amortize signature costs. - Cloudflare and customers already have an account-based trust relationship. - Custom PKIs can be used without relying on public WebPKI constraints such as intermediate certificates and Certificate Transparency. - Cloudflare is pursuing Merkle Tree Certificates for visitor-to-Cloudflare authentication, but ML-DSA can be deployed sooner for origin connections. ## ML-DSA Support - Cloudflare supports all FIPS 204 ML-DSA parameter sets: - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 - ML-DSA-44 is recommended for most applications because it offers the best performance while providing NIST category 2 security strength. ## Custom Origin Trust Store - In Full (strict) SSL mode, Cloudflare validates origin certificates against trusted public CAs and Cloudflare’s Origin CA. - COTS lets customers replace that default trust store with a set of customer-controlled CAs. - Customers can now upload ML-DSA CAs. - Cloudflare will trust origin certificates that chain to those ML-DSA CAs. - COTS requires Advanced Certificate Manager. ## Authenticated Origin Pulls - AOP enables mutual TLS, allowing origins to require requests to come from Cloudflare. - It is available on all Cloudflare plan levels. - Per-zone and per-hostname AOP configurations now support ML-DSA certificates and private keys. - Private keys must be uploaded in FIPS 204 seed format. - The global AOP configuration does not yet support this capability and will require additional work. ## Preventing Downgrade Attacks - Simply supporting post-quantum algorithms is not enough if classical authentication methods remain trusted. - An attacker with the ability to forge classical credentials could force a connection to downgrade to a quantum-vulnerable mechanism. - Origins must therefore remove trust in classical authentication mechanisms where appropriate. - Cloudflare’s AOP and COTS configuration guidance explains how to prevent these downgrades. ## Configuration Requirements - Certificate generation requires OpenSSL 3.5.0 or later. - ML-DSA private keys must use the FIPS 204 seed-only encoding. - Customers configure: - An ML-DSA CA and origin certificate chain for COTS - An ML-DSA client certificate and private key for AOP - Configuration can be performed through the Cloudflare API, with dashboard instructions available in the developer documentation. Cloudflare customers needing post-quantum protection for origin connections should combine ML-DSA-based COTS and AOP, explicitly remove trust in classical alternatives, and use ML-DSA-44 unless their security requirements justify a larger parameter set.