Cloudflare Explores Post-Quantum Privacy Pass Credentials With MOLE
Summary
Cloudflare examines MOLE, a proposed framework for post-quantum anonymous web credentials that can hide which trusted anchor issued an endorsement. Its VOLE-in-the-Head and multivariate constructions remain under development.
Key points
- Privacy Pass currently relies on RSA and elliptic-curve cryptography, which the article says could let a quantum attacker forge tokens; token unlinkability would still protect client privacy.
- MOLE is designed to let a moderator verify that an endorsement came from a trusted anchor without learning which anchor issued it.
- The article explains how VOLE-in-the-Head proofs and multivariate signature schemes such as UOV and MAYO can support post-quantum blind signatures and credentials.
- Cloudflare describes PoMFRIT with UOV as a 4.3 KB blind-signature construction, trading smaller signatures for larger public keys.
- Cloudflare’s current estimates for VOLE-IHAT and VOLE-ACT include presentation sizes of 6.5 KB and 12.0 KB, respectively; the figures may change as the schemes develop.
- The proposed constructions still need security proofs, and the article says further cryptanalysis of multivariate cryptography is needed before relying on them.
Article Details
- Attack Vectors
- The article says a sufficiently capable quantum attacker could exploit Privacy Pass's reliance on classical RSA and elliptic-curve cryptography to forge tokens and bypass site controls such as rate limiting.
- Researchers at the University of California, San Diego, and INRIA reportedly forged a 1024-bit RSA signature using a Privacy Pass issuer as a signing oracle.
- Defensive Notes
- The article states that Privacy Pass uses 2048-bit RSA and other defense mechanisms, which provide a security margin against the described signing-oracle attack.
- The authors say further study is needed before relying heavily on the proposed optimizations, including security proofs and additional cryptanalysis of UOV-based constructions.