Building an AI-Powered System for Post-Quantum Cryptography Migration at Cloudflare

Cloudflare faces the monumental task of migrating its entire infrastructure to post-quantum (PQ) cryptography by 2029. Given the foundational role of cryptography in their services, this "PQ everything!" approach necessitates a systematic method to identify, analyze, and update cryptographic implementations across their massive codebase. To address this, they developed CryptoLabe, an internal AI-powered tool designed to automate and orchestrate this complex migration.

The Challenge of Cryptography Discovery at Scale

The scale of Cloudflare's operations presents several challenges for cryptography discovery. Their centralized codebase spans numerous repositories, making a simple grep insufficient. Cryptography often "hides" in shared libraries, protocol defaults (e.g., TLS 1.3 key exchange configurations), or distant configuration files, making direct pattern matching unreliable. Furthermore, understanding *how* cryptography is used (e.g., an ECDSA signature in JWT, IPsec, TLS, or SSH) is crucial, as each context demands a different migration strategy. AI is employed to overcome these limitations by performing deep code analysis, following evidence across files, and enriching findings with internal documentation.

CryptoLabe's Two-Stage AI Scan Architecture

CryptoLabe's scanning process is divided into two main stages: Discovery and Analysis. The Discovery Stage maps a repository and searches for cryptographic use across source code, configuration, manifests, lockfiles, scripts, tests, and documentation, generating "raw observations." The Analysis Stage then re-checks observations, investigates runtime usage, identifies dependencies, and inspects related code in other repositories. It then classifies findings (e.g., Classical encryption, PQ-ready hybrid key exchange) and generates detailed reports for product managers and engineers.

• Classical encryption: Detects uses like ECDHE (X25519, P-256) or RSA key agreement, vulnerable to Shor's algorithm.
• Classical signature: Identifies RSA or ECDSA signatures in certificates, TLS handshakes, etc., also vulnerable to Shor's algorithm.
• Classical token: Specifically flags JWTs using RS256 or ES256 signatures.
• PQ-ready hybrid key exchange: Finds TLS 1.3 with X25519MLKEM768, Cloudflare's prevalent PQ encryption.
• PQ-ready: Catches other post-quantum cryptography uses, such as ML-DSA.

Underlying Platform and Orchestration

CryptoLabe is built on Cloudflare's Developer Platform, leveraging several key components: A scanner Worker performs the actual scans, while an inventory Worker handles the dashboard, API, and stores data in a D1 database. Service Bindings facilitate communication between these Workers. Scan orchestration is managed by Durable Objects, with each repository having a persistent coordinator. Cloudflare Workflows are used to persist progress and manage retries for the discovery, deep analysis, merge, and publish stages. For isolated code access, repositories are snapshotted into R2 storage and restored into ephemeral Cloudflare Sandboxes for analysis.