Using AI to chart a course for our post-quantum migration

Cloudflare has set a 2029 target to complete its migration to post-quantum cryptography, focusing on both encryption and authentication across its platform. While many products already use post-quantum encryption over TLS 1.3, the company acknowledges gaps in post-quantum authentication and the need to upgrade legacy systems. The effort requires identifying cryptographic use cases across thousands of repositories, where cryptography often appears indirectly or in dependencies rather than explicitly in code.

To address this, Cloudflare developed an internal tool called CryptoLabe, inspired by the mariner’s astrolabe, to discover and analyze cryptographic operations in its codebase. The tool scans repositories, configuration files, and documentation to identify key agreement, signatures, encryption, and other cryptographic functions. Unlike simple pattern matching, CryptoLabe traces how cryptography is used at runtime and its dependencies, providing structured insights rather than raw data.

CryptoLabe operates in two stages: discovery and analysis. The discovery stage maps repositories and searches for cryptographic elements across source code, manifests, and tests, producing raw observations. The analysis stage then validates these observations, examines runtime usage, and cross-references related code in other repositories to resolve conflicts or missing evidence. The tool’s classifiers categorize risks, such as classical key exchange algorithms vulnerable to quantum attacks, and identify post-quantum replacements like X25519MLKEM768.

The output of CryptoLabe is a report tailored for product managers and engineers, detailing migration requirements and execution steps. While still evolving, the tool is not yet available to customers, but Cloudflare is sharing its methodology to help others in their post-quantum migration efforts. The company emphasizes the importance of early identification of prerequisites to meet its 2029 timeline.