Cloudflare targets 2029 for quantum-safe internet

Cloudflare announced a plan to deploy post-quantum cryptographic protocols across its global network by 2029. The company said the program will protect web traffic and reduce risks to systems that rely on current public-key cryptography, including Bitcoin.

The rollout will phase in post-quantum algorithms and hybrid key-exchange methods across Cloudflare’s edge services and infrastructure over the next five years. The company plans to adopt standards from the National Institute of Standards and Technology and to use vetted algorithms such as Kyber for key encapsulation and Dilithium for digital signatures as implementation details are finalized.

Cloudflare described the technical concern driving the effort: sufficiently powerful quantum computers running Shor’s algorithm could derive private keys from public keys and break elliptic-curve and other widely used public-key systems. For Bitcoin, the immediate risk applies when an address or transaction reveals a public key; a quantum-capable adversary could compute the matching private key and spend funds before the rightful owner moves them. Captured encrypted internet traffic could also be decrypted later if attackers obtain quantum-capable machines, a scenario known as “record now, break later.”

The company said the deployment will be gradual and coordinated with browser vendors, standards bodies and other infrastructure providers to ensure compatibility and limit disruptions. Cloudflare noted the work requires testing, client software updates and hardware and library changes before large-scale rollout.

Cloudflare has previously run experiments and limited rollouts of post-quantum key exchange techniques and will expand testing on production traffic. The company plans to provide tools and guidance for customers that need to protect long-lived keys, including cryptocurrency custodians and exchanges.

Security researchers have advised organizations that hold long-lived secrets to plan migrations to post-quantum algorithms. Within the cryptocurrency community, recommended practices include avoiding address reuse, moving funds to post-quantum–resistant schemes when available, and using multi-signature and hardware security solutions to reduce exposure.

Cloudflare said it will monitor NIST guidance and work with standards groups and industry partners as it implements the 2029 timetable.