Cloudflare's Automatic Key Exchange for Faster, Post-Quantum Secure Origin Handshakes
Cloudflare's Automatic Key Exchange optimizes TLS 1.3 handshakes to origin servers by dynamically selecting the optimal key agreement algorithm, including post-quantum secure options, reducing latency and ensuring future-proof security. This system design leverages out-of-band scanning and adaptive rollout mechanisms to enhance connection efficiency and security at scale, avoiding breaking changes for millions of domains. The innovation addresses the "harvest-now, decrypt-later" threat by automatically enabling post-quantum cryptography without manual configuration.
Read original on Cloudflare BlogOptimizing TLS 1.3 Handshakes with Automatic Key Exchange
Cloudflare developed Automatic Key Exchange to solve a critical problem in TLS 1.3 handshakes to origin servers: the need to guess the key agreement algorithm in the initial ClientHello. A wrong guess leads to a `HelloRetryRequest` (HRR), adding a full network round trip and significant latency. By replacing this guess with an intelligent, data-driven approach, Cloudflare dramatically reduced HRRs and improved connection setup times.
The Challenge of Predictive Key Exchange
TLS 1.3's "predictive key exchange" aims for a single round-trip handshake. However, it requires the client (Cloudflare, acting as a reverse proxy) to send a key share with its `ClientHello` before knowing the origin's preferred algorithm. A mismatch necessitates a retry, effectively doubling the handshake latency for that connection.
System Architecture: Out-of-Band Scanning and Adaptive Rollout
- Origin Probing: For each TLS 1.3-capable origin, Cloudflare runs lightweight, out-of-band TLS handshakes. These probes test various key agreement groups (X25519, P-256, P-384, P-521, X25519MLKEM768) to map the origin's full capabilities without affecting production traffic.
- Preference Selection: Based on the scan results, the system selects the strongest supported candidate. Post-quantum hybrid algorithms (like X25519MLKEM768) are prioritized, falling back to the fastest classical algorithm.
- Traffic-Weighted Decisions: If a domain has multiple subdomains resolving to different origins, the system weights the scan results by actual traffic volume. This ensures the domain-wide key exchange preference reflects the busiest endpoints.
- Gradual Rollout and Monitoring: New preferences are rolled out to a small share of an origin's traffic initially. The system continuously monitors failure rates and HRRs. If retries climb, the change is automatically rolled back, ensuring resilience.
- Daily Rescanning: Origin configurations are dynamic. Cloudflare rescans every origin daily to adapt to changes (e.g., new load balancers, TLS library upgrades, added post-quantum support), maintaining optimal performance and security over time.
Balancing Security and Performance with Post-Quantum Cryptography
A key driver for Automatic Key Exchange is the push towards post-quantum (PQ) security. Traditional key shares (like X25519) are small, fitting into a single packet. PQ key shares (e.g., X25519MLKEM768) are significantly larger, potentially splitting the `ClientHello` across multiple packets, which can break connections with legacy middleboxes or origin servers. Cloudflare initially advertised PQ support but used HRR as a "safety valve" – requiring origins to request PQ via a retry. This ensured compatibility but sacrificed latency. The new system enables leading with PQ key shares where compatible, without risking outages, moving closer to the goal of making the Internet quantum-secure by 2029 (Q-Day) without manual intervention from millions of website operators.