Skip to content

Commit 7f6dfea

Browse files
Overall text review and remove previous origin instructions
1 parent cf3fd60 commit 7f6dfea

File tree

1 file changed

+4
-23
lines changed

1 file changed

+4
-23
lines changed

src/content/docs/ssl/post-quantum-cryptography/pqc-to-origin.mdx

Lines changed: 4 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ If the origin supports post-quantum hybrid key agreement, it can use HelloRetryR
2626

2727
### Cloudflare zone settings
2828

29-
The method described above is the one used to allow Cloudflare to support post-quantum to all outbound connections. However, if your origin server supports PQC and prefers it, you can use the [API](/api/operations/zone-cache-settings-change-origin-post-quantum-encryption-setting) to adjust it and avoid the extra round trip.
29+
The method described above is the one Cloudflare uses to support post-quantum to all outbound connections. However, if your origin server supports PQC and prefers it, you can use the [API](/api/operations/zone-cache-settings-change-origin-post-quantum-encryption-setting) to adjust your Cloudflare zone settings and avoid the extra round trip.
3030

3131
It is also possible to opt out of PQC using the same API endpoint.
3232

@@ -51,34 +51,15 @@ The possible values are:
5151

5252
### Origin server
5353

54-
To make sure that your origin server prefers the post-quantum key agreement use the `bssl` tool of [BoringSSL](https://github.com/google/boringssl):
55-
56-
<Example>
57-
```bash
58-
$ bssl client -connect (your server):443 -curves X25519MLKEM768 ```
59-
Verify that the `ECDHE curve` in the handshake output indicates `X25519MLKEM768`.
60-
</Example>
61-
62-
1. Use Cloudflare's [fork of BoringSSL](https://github.com/cloudflare/boringssl-pq).
63-
2. Use the `bssl` tool of BoringSSL:
64-
65-
- If you set your Cloudflare zone to `supported`, check that your origin prefers the hybrid key agreement, by using the `-disable-second-keyshare` parameter:
66-
67-
<Example>
68-
```bash
69-
$ cd boringssl-pq && cmake -B build && make -C build
70-
$ build/bssl client -connect (your server):443 -curves X25519:X25519MLKEM768 -disable-second-keyshare
71-
```
72-
Verify that the `ECDHE curve` in the handshake output indicates `X25519MLKEM768`.
73-
</Example>
74-
75-
- If you set your Cloudflare zone to `preferred`, check that your origin supports the correct key agreement:
54+
To make sure that your origin server prefers the post-quantum key agreement, use the `bssl` tool of [BoringSSL](https://github.com/google/boringssl):
7655

7756
<Example>
7857
```bash
7958
$ bssl client -connect (your server):443 -curves X25519MLKEM768
8059
```
60+
8161
Verify that the `ECDHE curve` in the handshake output indicates `X25519MLKEM768`.
62+
8263
</Example>
8364

8465
[^1]: When, to remove a round trip, a client makes a guess of what the server supports.

0 commit comments

Comments
 (0)