Cloudflare has published cost estimates for post-quantum versions of the anonymous tokens behind Privacy Pass, and says the cryptography is now far enough along that the work can shift from design to protocol engineering.

The post, listing Bas Westerbaan as author, explains that Privacy Pass lets a site rate-limit clients without CAPTCHAs or fingerprinting by issuing tokens that cannot be linked to the client. Today’s tokens rely on RSA and elliptic curves, so Cloudflare says a quantum attacker could forge tokens at will and bypass the rate limiting a site operator has set. Privacy itself is unaffected: the post says Privacy Pass is unconditionally private, so no attacker can link a token’s redemption to its issuance.

Size is the obstacle. Cloudflare notes that ML-DSA-44 signatures are 2,420 bytes against 64 bytes for ECDSA-P256, and expects no drop-in replacement soon. The post describes a next-generation design called MOLE, for Moderation Of unLinkable Endorsements, and two candidate schemes built on multivariate cryptography. Its current estimates are 5.6KB to issue and 6.5KB to redeem for the VOLE-IHAT endorsement, and 5.4KB to issue and 12.0KB to spend for the VOLE-ACT credential. Each operation takes a few milliseconds, and the public keys are 46.6KB. Cloudflare says the numbers may change.

Why it matters

Cloudflare lists two open items before deployment: security proofs showing the schemes are as secure as UOV, and further cryptanalysis of UOV. It says replacing RSA blind signatures with its PoMFRIT scheme carries overhead comparable to replacing ECDSA with ML-DSA, and that it will have to work out how to spread one redemption over several requests.

What to do

In our reading, security teams building bot and abuse controls on token schemes should add them to the post-quantum inventory next to TLS, and note which controls would fail open if tokens could be forged. Related: Cloudflare on AI agents and the users behind them and Let’s Encrypt’s 64 day certificate lifetime.

Source: Cloudflare Blog, The post-quantum future of web privacy