Cloudflare's Automatic Key Exchange slashes connection delays by 150ms, enables post-quantum encryption for hundreds of thousands of domains without manual configuration to combat harvest-now-decrypt-later attacks before Q-Day 2029.

Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)

Every time Cloudflare opens a new TLS 1.3 connection to an origin server, we have to make a guess: the protocol requires us to commit to a key agreement algorithm in the very first packet we send, before the origin has told us anything about itself or what it can support. If we guess right, the handshake completes in one round trip. Guess wrong, and the origin replies with a HelloRetryRequest, we start over, and the connection costs two round trips.For years, our guess was the same for every ori...