Cloudflare Adds Post-Quantum TLS Visibility to Analytics and Logs
Summary
Cloudflare added TLS 1.3 post-quantum key-exchange visibility to HTTP Traffic Analytics, Logpush and Log Explorer, giving customers domain-level and per-connection telemetry to assess adoption and identify migration gaps.
Key points
- The new telemetry identifies negotiated TLS key-exchange groups for visitor-to-Cloudflare connections in analytics and individual request logs.
- Customers can enable the ClientTLSKeyExchangeGroup log field; Logpush also exposes the Cloudflare-to-origin group as OriginTLSKeyExchangeGroup.
- X25519MLKEM768 is the post-quantum TLS 1.3 key-exchange group highlighted by Cloudflare; the article notes that TLS 1.2 and earlier do not support post-quantum encryption.
- Cloudflare reports that about 70% of browser-generated traffic reaching its network uses hybrid ML-KEM, compared with about 15% of origins it connects to; these are aggregate figures.
- Cloudflare says customers finding no post-quantum traffic should confirm TLS 1.3 is enabled. It also describes using Cloudflare Tunnel to connect legacy origins over TLS 1.3 with X25519MLKEM768.
Article Details
- Event Type
- Cloudflare product feature launch introducing post-quantum TLS visibility in HTTP Traffic Analytics, Logpush, and Log Explorer.
- Impact
- Customers can inspect and filter per-domain, per-connection TLS key exchange data for visitor-to-Cloudflare traffic and view Cloudflare-to-origin key exchange data in Logpush. This supports auditing post-quantum adoption, assessing compliance, troubleshooting migration gaps, and identifying traffic still using classical cryptography. Cloudflare says the visibility can help organizations protect traffic against harvest-now-decrypt-later attacks.
People
Vendors
Products
Cloudflare Radarwe already have macro-level visibility into Internet-wide post-quantum adoption in TLS through Cloudflare Radar. On Radar, we track global post-quantum encryption statistics, both when Cloudflare proxies HTTPCloudflare Tunnelto support modern post-quantum cryptography, don’t despair. You can put the origin server behind a Cloudflare Tunnel, to tunnel traffic from the origin server to Cloudflare over TLS 1.3 with X25519MLKEM768, withoutHTTP Traffic AnalyticsTLS 1.3 encryption for live traffic from directly within Logpush, Log Explorer, and the HTTP Traffic Analytics dashboard. By surfacing the key exchange algorithm negotiated on every incoming request fromLog Explorergraph the adoption of post-quantum TLS 1.3 encryption for live traffic from directly within Logpush, Log Explorer, and the HTTP Traffic Analytics dashboard. By surfacing the key exchange algorithm negotiated on everyLogpushinspect and graph the adoption of post-quantum TLS 1.3 encryption for live traffic from directly within Logpush, Log Explorer, and the HTTP Traffic Analytics dashboard. By surfacing the key exchange algorithm
Industries
Defenseonline. Organizations that have data that are valuable even if decrypted in 3–10 years (public sector, defense, finance, telecom, healthcare, and others), should consider immediately protecting their traffic withfinanceOrganizations that have data that are valuable even if decrypted in 3–10 years (public sector, defense, finance, telecom, healthcare, and others), should consider immediately protecting their traffic with post-quantumHealthcarehave data that are valuable even if decrypted in 3–10 years (public sector, defense, finance, telecom, healthcare, and others), should consider immediately protecting their traffic with post-quantum encryption. Public Sectorcome online. Organizations that have data that are valuable even if decrypted in 3–10 years (public sector, defense, finance, telecom, healthcare, and others), should consider immediately protecting theirTelecommunicationsthat have data that are valuable even if decrypted in 3–10 years (public sector, defense, finance, telecom, healthcare, and others), should consider immediately protecting their traffic with post-quantum