Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)
Curated from Cloudflare Blog
Post-quantum cryptography is no longer a theoretical concern; it is becoming a practical operational requirement. Cloudflare’s implementation of Automatic Key Exchange addresses a critical friction point in this transition: the complexity of managing hybrid key agreements across millions of diverse server configurations. By automating the discovery of supported algorithms, they remove the manual overhead typically associated with deploying new cryptographic standards. This is particularly relevant for SREs managing large-scale edge networks or distributed backends, where handshake failures can cascade into significant availability issues. The article details how they prioritize secure algorithms during the origin handshake, balancing performance with long-term security needs. For practitioners, the key takeaway is that automating cryptographic capability discovery is essential to scaling post-quantum security without sacrificing reliability or increasing operational toil.
Automatic Key Exchange probes TLS 1. 3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it.
— Cloudflare Blog