Cloudflare: 45 billion daily connections see automated post-quantum key exchange

Cloudflare has begun automatically selecting post-quantum key exchange for connections to compatible origin servers, with protected traffic reaching about 45 billion connections per day as transport layer security (TLS) handshake delays fall.

The company’s new Automatic Key Exchange capability probes origin servers to determine which cryptographic algorithms they support, then selects the strongest compatible option when establishing a TLS 1.3 connection. It prioritizes the hybrid post-quantum algorithm X25519MLKEM768 and falls back to an appropriate classical algorithm when necessary.

Cloudflare said post-quantum origin traffic among the scanned cohort increased from roughly 25 billion to 45 billion daily connections during the rollout, with Automatic Key Exchange contributing significantly to that growth. The proportion of post-quantum TLS 1.3 connections completing in a single network round trip rose from zero to 99.2%.

The feature addresses a limitation in the TLS 1.3 handshake. When initiating a connection, a client must send a cryptographic key share before the server has indicated which algorithm it prefers. If the server rejects that choice, it issues a HelloRetryRequest and the client must try again, adding another network round trip.