Cloudflare Launches Post-Quantum Encryption for IPsec to Thwart Future Quantum Attacks
Breaking: Cloudflare Makes Post-Quantum IPsec Encryption Generally Available
Cloudflare announced today the general availability of post-quantum encryption for its IPsec service, a move that lets enterprises shield wide-area networks against harvest-now-decrypt-later attacks using existing hardware. The new encryption, based on the hybrid ML-KEM standard (FIPS 203), has been tested successfully with branch connectors from Fortinet and Cisco.
“This is a critical step to protect network traffic against the looming threat of quantum computers breaking current encryption,” said a Cloudflare spokesperson. “Organizations can now deploy post-quantum security without replacing their hardware.”
The announcement comes as quantum computing advances accelerate, prompting Cloudflare to move its target for full post-quantum security to 2029. The company notes that while TLS traffic is already largely protected, IPsec has lagged due to interoperability challenges.
Background: The Long Road to Post-Quantum IPsec
IPsec has been the backbone of site-to-site networking for decades, but implementing post-quantum cryptography proved far more complex than for TLS. The IPsec community had to balance Internet-scale interoperability with the constraints of specialized hardware.
“It took four years longer to land the hybrid handshake for IPsec than for TLS,” a Cloudflare engineer explained. “But now the industry is finally consolidating around a standard that works at scale.”
The new draft, draft-ietf-ipsecme-ikev2-mlkem, combines classical Diffie-Hellman with ML-KEM to ensure security even if one is broken. ML-KEM is software-based and requires no special hardware.
What This Means for Enterprise Networks
Harvest-now-decrypt-later attacks are a growing concern as Q-Day—the day quantum computers can crack public-key cryptography—approaches faster than predicted. With this launch, organizations can start encrypting their WAN traffic today to prevent adversaries from harvesting data for future decryption.
“Cloudflare IPsec customers can now enable post-quantum protection with no downtime or hardware upgrades,” said the spokesperson. “It’s a plug-and-play defense against tomorrow’s threats.”
The service is available immediately for all Cloudflare IPsec users. The company recommends testing on non-critical tunnels first, given the larger handshake size.
Key Benefits at a Glance
- Future-proof security: Hybrid ML-KEM protects against both current and quantum attacks.
- Hardware compatibility: Works with existing Cisco, Fortinet, and other branch connectors.
- No infrastructure change: Software-based algorithm runs on standard processors.
For more details, visit the official announcement.
Related Articles
- Meta Deploys Post-Quantum Cryptography Across Internal Systems, Urges Industry to Prepare Now
- Design Systems at Breaking Point: 'Consistency Has Become a Prison', Expert Warns
- Segway's Xaber 300: The 60 MPH Electric Dirt Bike That Redefines Off-Road Riding
- Inside the $10,000 Bet: Will We Have Self-Driving Cars by 2030?
- Crypto Market Surge and Regulatory Shifts: XMR ATH, Stablecoin Limits, and Prediction Market Crackdown
- Cloudflare and Stripe Launch Agent-Driven Account and Domain Provisioning
- 8 Ways Designers Can Redefine Success for Ethical Design
- How a Bank Uses Quantum Computing and AI to Predict Earthquakes and Manage Wildfire Risk