Cloudflare Uses AI to Map Cryptography for Post-Quantum Migration
Summary
Cloudflare describes CryptoLabe, an internal AI tool that maps cryptography across repositories to guide its post-quantum migration. The article details its scan workflow, limitations, hard-case detection, and advice for prioritizing systems.
Key points
- CryptoLabe scans source code, configuration, manifests, tests, and documentation, then analyzes each observation in context to determine how cryptography is used and classify findings.
- The tool can inspect related repositories and internal documentation, and checks its conclusions for missing or conflicting evidence; findings without enough evidence are marked for further review rather than guessed.
- Scans use an exact-commit repository snapshot in an isolated, read-only sandbox. Cloudflare uses workflows and durable coordinators to manage scan progress, retries, and model request rates.
- A separate scan looks for hard cases such as custom cryptographic protocols, dependencies without post-quantum support, and certificates carried in HTTP headers, where larger post-quantum certificates may encounter size limits.
- Cloudflare says its scans are still evolving: it lacks a ground-truth dataset to compare prompts and cannot claim complete coverage. Engineers review findings with repository owners.
- For other organizations, Cloudflare recommends starting with important systems, validating discovered cryptography with their owners, and prioritizing upgrades and shared prerequisites rather than inventorying every repository first.
Article Details
- Topic
- Cloudflare's AI-assisted cryptography discovery and prerequisite analysis for planning its post-quantum migration.
People
Andrew GalloniAcknowledged for providing feedback on and contributing to CryptoLabe, Cloudflare's cryptography-discovery tool.Christopher PattonAcknowledged for providing feedback on and contributing to CryptoLabe, Cloudflare's cryptography-discovery tool.Davide MarquêsAcknowledged for providing feedback on and contributing to CryptoLabe, Cloudflare's cryptography-discovery tool.JP AumassonAcknowledged for providing feedback on and contributing to CryptoLabe, Cloudflare's cryptography-discovery tool.Luke ValentaAcknowledged for providing feedback on and contributing to CryptoLabe, Cloudflare's cryptography-discovery tool.Mari GalicerAcknowledged for providing feedback on and contributing to CryptoLabe, Cloudflare's cryptography-discovery tool.Peter WuAcknowledged for providing feedback on and contributing to CryptoLabe, Cloudflare's cryptography-discovery tool.Phil SchmiederAcknowledged for providing feedback on and contributing to CryptoLabe, Cloudflare's cryptography-discovery tool.Vânia GonçalvesAcknowledged for providing feedback on and contributing to CryptoLabe, Cloudflare's cryptography-discovery tool.
Vendors
Products
AI GatewayFor cost, the model loop sends its requests through AI Gateway to cost-effective open-weight models hosted on Workers AI. Putting the model behind AI Gateway also makes it easy to switch models as better or cheaper onesCloudflare oneencryption already today; check this out with our new PQ visibility features. Our SASE platform, Cloudflare One, provides post-quantum encryption for private network traffic. Post-quantum encryption is provided atCloudflare Sandboxthen stores that snapshot in R2. Each Workflow then restores the snapshot into a fresh, short-lived Cloudflare Sandbox, an isolated container. The model then works with the Sandbox through a small set of read-onlyCloudflare WorkersCryptoLabe runs across two Cloudflare Workers. There’s a scanner Worker that runs the scans. And there’s an inventory Worker that serves the dashboard, exposes the API, and stores everything in a D1 database. The twoCloudflare WorkflowsThe coordinator doesn't do the analysis itself. It hands the work to Cloudflare Workflows, so that they can persist progress and automatically retry failed steps. The coordinator moves each repository through fourD1And there’s an inventory Worker that serves the dashboard, exposes the API, and stores everything in a D1 database. The two communicate through Service Bindings. A scan starts when someone requests it from theDurable Objectsystem. We did this with Agents SDK. Each repository gets its own persistent coordinator built on a Durable Object (DO). A bounded queue in front of the coordinators limits how many scans run at once. When a scan'sR2the repository once, at an exact commit, at the start of each scan, and then stores that snapshot in R2. Each Workflow then restores the snapshot into a fresh, short-lived Cloudflare Sandbox, an isolatedWorkers AIthe model loop sends its requests through AI Gateway to cost-effective open-weight models hosted on Workers AI. Putting the model behind AI Gateway also makes it easy to switch models as better or cheaper ones