Cloudflare Leverages AI for Post-Quantum Cryptography Migration

Cloudflare is aggressively pursuing a 2029 deadline to achieve full post-quantum (PQ) cryptographic readiness across its platform. While many of its products have already adopted PQ encryption, the company still faces the challenge of migrating its authentication mechanisms and ensuring comprehensive PQ support. This initiative is driven by Cloudflare's commitment as an infrastructure provider to offer its customers future-proof security against the emerging threat of quantum adversaries.

The company has outlined three primary objectives for its PQ migration. Firstly, it aims to equip its product and engineering teams with a clear understanding of current cryptography usage and the necessary upgrade paths for both encryption and authentication. This includes addressing the remaining TLS connections and other uses of public-key encryption, alongside the nascent deployment of PQ authentication.

Secondly, Cloudflare intends to establish robust progress metrics for the migration. These metrics will provide visibility into the adoption of classical and PQ cryptography on a per-repository and per-product basis, enabling effective tracking of the transition's advancement. This data-driven approach is crucial for managing such a large-scale undertaking.

Finally, the company seeks to proactively identify and surface any prerequisites or dependencies that could impede its migration timeline. This involves recognizing when products or platform components rely on protocols or systems that lack PQ migration plans, or where PQ standards, software libraries, or ecosystem components are not yet mature. Early identification allows Cloudflare to collaborate with stakeholders, standards bodies, and the wider ecosystem to drive necessary developments and ensure its own 2029 target is met.

To tackle the immense scale of this challenge, Cloudflare has developed an internal AI-powered tool called CryptoLabe. Named after the ancient mariner's navigation instrument, CryptoLabe is designed to discover cryptography within Cloudflare's extensive codebase, analyze its usage, and map out the migration path to PQ standards. While not available to external customers due to its specialization in Cloudflare's internal systems, the company is sharing its learnings to aid other organizations.

The complexity of cryptography discovery within Cloudflare's centralized codebase presents significant hurdles. These include managing numerous repositories, the often-obscured nature of cryptographic implementations within shared libraries and configuration files, and the presence of dead or test-only code paths. Furthermore, simple pattern matching is insufficient, as it can overcount unused cryptography and undercount indirect uses, failing to capture the context of how cryptography is employed.

AI has proven to be a powerful solution for these challenges. CryptoLabe leverages AI models to scan codebases, trace evidence across files, and provide structured analysis. It can also enrich findings with data from internal documentation and ticketing systems, offering explanations on cryptographic usage and upgrade requirements. The tool's current implementation involves a two-stage scanning process: first, mapping repositories, and second, searching for cryptography across source code, configurations, manifests, lockfiles, scripts, tests, and documentation.

This AI-driven approach allows Cloudflare to move beyond basic text searches and gain a deeper, more accurate understanding of its cryptographic landscape. By automating and enhancing the discovery and analysis process, CryptoLabe is instrumental in charting a clear and achievable course towards Cloudflare's ambitious post-quantum migration goals, ensuring the long-term security of its platform and customer data.

Cloudflare has expanded its post-quantum cryptography (PQC) offerings by introducing new visibility tools within its Application Security and Logs products. Customers can now inspect and graph the adoption of PQ TLS 1.3 encryption for live traffic, enabling granular telemetry to audit their PQC posture and identify cryptographic gaps across their domains. This move complements Cloudflare's broader efforts to facilitate the transition to quantum-readiness, including its internal AI tool, CryptoLabe, which aids in managing its own PQC migration.