The Quantum Threat Is Closer Than You Think

For years, post-quantum cryptography (PQC) has been a buzzword reserved for futurists. But with recent advances in quantum computing, the timeline has shrunk dramatically. Cloudflare now targets full post-quantum security by 2029, and this week they took a major step: post-quantum encryption for Cloudflare IPsec is generally available.

This isn't just another feature release. It's the first time a major CDN and network provider has delivered interoperable, standards-based PQC for site-to-site IPsec tunnels. And yes, it works with your existing Cisco and Fortinet hardware.

What's Actually New?

  • Hybrid ML-KEM (FIPS 203) is now the default key exchange mechanism for Cloudflare IPsec.
  • The implementation follows the IETF draft draft-ietf-ipsecme-ikev2-mlkem, which combines classical Diffie-Hellman with ML-KEM in a single handshake.
  • Interoperability confirmed with Cisco 8000 Series routers (IOS XR 26.1.1+) and Fortinet FortiOS 7.6.6+.

This means you can start protecting your WAN against harvest-now-decrypt-later attacks without buying new hardware. The same routers you already have can now negotiate a post-quantum-secure tunnel.

Why IPsec Took 4 Years Longer Than TLS

The TLS community moved fast: Cloudflare turned on hybrid post-quantum key agreement for TLS back in 2022, before NIST even finalized ML-KEM. IPsec took much longer. Why?

  1. Quantum Key Distribution (QKD) distraction: The IPsec community spent years pursuing QKD (RFC 8784), which requires specialized hardware and dedicated physical links. It doesn't scale to the Internet. Both the NSA and Germany's BSI have warned against relying solely on QKD.
  2. Ciphersuite bloat: RFC 9370 (2023) opened the door for parallel key exchanges in IPsec, but didn't specify which ciphersuites to use. Vendors shipped incompatible implementations, leading to fragmentation.
  3. Interoperability is harder for IPsec: Unlike TLS, which is mostly client-server, IPsec connects many different vendors' hardware in complex topologies. Getting everyone to agree on a single standard takes time.

Now, draft-ietf-ipsecme-ikev2-mlkem fills that gap. It's the first IPsec-specific PQC standard that major vendors can agree on.

How the Hybrid Handshake Works

Let's break down what happens when your branch router connects to Cloudflare's network with post-quantum IPsec:

1. Classical Diffie-Hellman exchange (X25519)
   → generates a shared secret K1

2. K1 encrypts the ML-KEM exchange
   → generates a second shared secret K2

3. Both K1 and K2 are mixed into the final session key
   → ESP data plane traffic is encrypted with AES-256-GCM

This hybrid approach ensures that even if quantum computers eventually break Diffie-Hellman, the ML-KEM component still protects your data. And if ML-KEM ever shows weakness (unlikely, but defense in depth), the classical component remains strong.

For a deeper look at how large-scale platforms handle complex feature rollouts, check out this article on Meta's unified AI agent platform for capacity efficiency.

Current Interoperability Matrix

VendorProductMinimum VersionStatus
CloudflareIPsec (native)GA✅ Reference implementation
Cisco8000 Series RoutersIOS XR 26.1.1✅ Tested
FortinetFortiGateFortiOS 7.6.6✅ Tested
Palo Alto NetworksNGFWN/A❌ Not yet interoperable

Note: Palo Alto Networks shipped an RFC 9370-based implementation before the ML-KEM draft was available, using custom ciphersuites. Cloudflare hopes to add them soon as the industry consolidates.

Limitations and Caveats

  • Authentication is still classical: This release only covers encryption. Post-quantum authentication for IPsec (e.g., post-quantum IKEv2 certificates) is not yet standardized. You still rely on classical signatures for identity verification.
  • Performance overhead: ML-KEM is computationally heavier than classical Diffie-Hellman. Cloudflare's implementation is optimized, but you may see a slight latency increase during the initial handshake (not during data transfer).
  • Vendor lock-in risk: While interoperability with Cisco and Fortinet is great, not every vendor supports it yet. If you use Juniper, Huawei, or others, you'll need to wait for their updates.

What's Next: Post-Quantum Authentication

The IPsec community now needs to standardize post-quantum authentication. The same draft working group is already discussing hybrid ML-DSA (FIPS 204) for IKEv2 certificates. Expect this to land sometime in 2026–2027.

If you're managing a multi-cloud or hybrid WAN, this is the moment to start testing. Configure a single branch with FortiOS 7.6.6+ or Cisco 8000 series, enable the Cloudflare IPsec tunnel, and verify the handshake uses ML-KEM. Your security team will thank you.

Also, if you're into modern feature flagging and A/B testing at scale, don't miss our guide on Vercel Flags now supporting JSON values for model switching.

Summary

  • Cloudflare IPsec now supports hybrid ML-KEM for post-quantum encryption.
  • Interoperable with Cisco and Fortinet on existing hardware.
  • Harvest-now-decrypt-later attacks are the immediate threat this mitigates.
  • Post-quantum authentication is the next frontier, expected in 2026–2027.
  • Start testing today — no new hardware required.

Based on Cloudflare's official announcement.

Cloudflare global network with post-quantum encrypted IPsec tunnels between data centers Coding Session Visual

This content was drafted using AI tools based on reliable sources, and has been reviewed by our editorial team before publication. It is not intended to replace professional advice.