The transition to post-quantum cryptography will not happen with a single update. It will have to span browsers, CDNs, servers, load balancers, TLS libraries, enterprise appliances, and an enormous amount of infrastructure that is not updated at the same time. Cloudflare has just changed one of the most sensitive steps in this migration by introducing Automatic Key Exchange, a system that learns which key exchange algorithms origin servers support and automatically chooses the most effective one in TLS 1.3 connections.
The scale makes the change significant: Cloudflare reports over 45 billion daily connections to origin servers. Any inefficiency that adds a round trip can multiply into latency, energy consumption, and operational cost. At the same time, switching to hybrid post-quantum schemes can increase message size and strain outdated servers. The new system attempts to address both needs.
The problem begins in the first packet
In TLS 1.3, the client must propose a key exchange group in the first message. If it chooses an algorithm supported by the server, the handshake proceeds in a single round trip. If it guesses wrong, the server responds with HelloRetryRequest and asks to try again with a different group. For years, Cloudflare has used X25519 as its default choice, a widely adopted and fast solution.
However, the company's measurements showed that this choice was not optimal for roughly 30% of connections to origins. With the arrival of post-quantum and hybrid algorithms, the problem becomes even more complex: not all servers support the same combinations, and a static approach slows down migration.
Automatic Key Exchange turns the network into a learning system
The new mechanism performs controlled probes to origins to determine which groups are accepted and stores this information. Subsequent connections can then directly use a more suitable choice. It is not machine learning in the trendy sense of the term; it is an observation and adaptation system that uses the scale of the network to eliminate unnecessary attempts.
This is particularly important when introducing groups like X25519MLKEM768, which combine classical cryptography with elements designed to withstand future quantum computers. A network that already knows which origins support them can gradually scale up their use without penalizing those left behind.
The quantum risk is in the future, the migration is happening now
Today, there are no quantum computers capable of breaking the public-key cryptography used across the internet at an operational scale. The problem is that replacing infrastructure takes years. Moreover, there is the “harvest now, decrypt later” scenario: an attacker can record encrypted traffic today and store it in the hope of decrypting it in the future once the technology becomes available.
For data with a long shelf life — trade secrets, government intelligence, medical records — this risk makes it sensible to begin the transition before the threat materializes. NIST standardization of post-quantum algorithms has given the industry a common foundation, but deployment at internet scale remains the hardest part.
CDNs are in a prime position to accelerate change
A company like Cloudflare sits between users and origin servers, and can upgrade a massive share of connections without requiring every site to re-engineer its application. This turns CDNs and network providers into force multipliers for the transition. If the browser speaks post-quantum with Cloudflare, but Cloudflare still uses only classical cryptography toward the origin, end-to-end protection remains incomplete. Upgrading the second leg therefore becomes essential.
Automatic Key Exchange reduces friction precisely here. It does not force all origins to upgrade on the same day, but allows the network to leverage new capabilities where they exist while maintaining compatibility elsewhere.
Performance is part of security
A security measure that introduces too much latency risks being disabled by operators. It is a recurring problem in the history of cryptography: the most technically robust solution loses adoption if it incurs operational costs that are too high. Cloudflare is therefore working to make the post-quantum path not only secure, but economically invisible.
Eliminating HelloRetryRequest may not seem revolutionary on a single connection. Across tens of billions of handshakes a day, however, it means cutting down an enormous amount of latency. It is this kind of optimization that allows a new standard to become the default rather than remaining an experimental option.
The real obstacle will be the long tail of the internet
Major cloud providers and modern browsers can update quickly. Far more challenging is the long tail made up of enterprise servers, appliances, embedded systems, and legacy software. Some will remain on outdated configurations for years. An adaptive mechanism makes it possible to coexist with this reality without giving up on improving the rest of the network.
The post-quantum transition will therefore be uneven. There will be no single day when the internet “becomes quantum-resistant.” Instead, there will be an adoption curve shaped by protocols, libraries, and fallbacks. Automatic Key Exchange is compelling precisely because it is designed for that intermediate phase.
The security of the future is built on barely visible changes
For the end user, nothing will change in the interface. No buttons, no new passwords. It is one of the paradoxes of infrastructure: some of the most critical changes happen beneath the visible layer of the web. When they work, we simply don’t notice.
Cloudflare is using its position on the network to turn a global cryptographic transition into a series of automated, connection-by-connection decisions. It is a pragmatic approach that acknowledges an often-overlooked truth: security doesn’t win when the best algorithm exists, but when that algorithm can be adopted without breaking the system it is meant to protect.
