Skip to content

Commit f815122

Browse files
Rename file, fill in, and link to pqc-support
1 parent 8d5d0c8 commit f815122

File tree

3 files changed

+43
-9
lines changed

3 files changed

+43
-9
lines changed

src/content/docs/ssl/post-quantum-cryptography/index.mdx

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ Cloudflare has deployed the following hybrid key agreements:
4141
- [X25519Kyber768Draft00](https://datatracker.ietf.org/doc/draft-tls-westerbaan-xyber768d00/) (Obsolete)
4242
- TLS identifier: `0x6399`
4343

44-
A hybrid key agreement lays the groundwork as more and more [clients](#visitor-to-cloudflare) adopt post-quantum cryptograph, while also maintaining the current security provided by X25519. It is a safer path in case of an unexpected breakthrough that renders all variants of ML-KEM insecure.
44+
A hybrid key agreement lays the groundwork as more and more [clients](#visitor-to-cloudflare) adopt post-quantum cryptography, while also maintaining the current security provided by X25519. It is a safer path in case of an unexpected breakthrough that renders all variants of ML-KEM insecure.
4545

4646
## Three connections in the life of a request
4747

@@ -65,6 +65,10 @@ flowchart LR
6565

6666
As of [october 2023](https://blog.cloudflare.com/post-quantum-for-all/), all websites and APIs served through Cloudflare over TLS 1.3 support post-quantum hybrid key agreement. However, the connection is only post-quantum secured if the client also supports post-quantum cryptography.
6767

68+
Refer to [Post-quantum cryptography support](/ssl/post-quantum-cryptography/pqc-support/) for a list of browsers and other clients that are compatible with hybrid key agreements.
69+
6870
### 2. Internal connections
6971

72+
73+
7074
### 3. Cloudflare to your origin
Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
pcx_content_type: reference
3+
title: PQC support
4+
sidebar:
5+
order: 3
6+
head: []
7+
description: Consider information about post-quantum cryptography at Cloudflare - deployed key agreements and software support.
8+
---
9+
10+
Cloudflare's deployment of post-quantum hybrid key agreements is supported by the following [third-parties](#software-support) and is in use within the following [Cloudflare products](#cloudflare-products).
11+
12+
## Software support
13+
14+
### X25519MLKEM768
15+
- Default for [Firefox 132+](https://www.mozilla.org/firefox/channel/desktop/) (Beta)
16+
- Default for [Chrome 131+](https://www.google.com/chrome/beta/) (Beta)
17+
- Cloudflare's [fork of Go](https://github.com/cloudflare/go)
18+
- [BoringSSL](https://boringssl.googlesource.com/boringssl/)
19+
20+
### X25519Kyber768Draft00
21+
22+
- Default for [Chrome 124-130](https://www.google.com/chrome/) on Desktop
23+
- For older Chrome or on mobile, toggle _TLS 1.3 hybridized Kyber support_ (`enable-tls13-kyber`) in `chrome://flags`.
24+
- Default for [Edge 124+](https://microsoft.com/edge/)
25+
- Default for recent [Opera](https://opera.com) and [Brave](https://brave.com)
26+
- [Firefox 124+](https://www.mozilla.org/firefox) if you turn on `security.tls.enable_kyber` in `about:config`
27+
- For QUIC/HTTP3, use Firefox 128+ with `network.http.http3.enable_kyber`.
28+
- Cloudflare's [fork of Go](https://github.com/cloudflare/go)
29+
- Default for [Go 1.23](https://github.com/golang/go/issues/67061)
30+
- [BoringSSL](https://boringssl.googlesource.com/boringssl/)
31+
- Cloudflare's [fork of QUIC-go](https://github.com/cloudflare/qtls-pq)
32+
- Goutam Tamvada's [fork of Firefox](https://github.com/xvzcf/firefox-pq-demos)
33+
- [Open Quantum Safe](https://openquantumsafe.org/) C library
34+
- [Zig 0.11.0+](https://ziglang.org/)
35+
- [nginx](https://www.nginx.org/) when [compiled with BoringSSL](https://mailman.nginx.org/pipermail/nginx/2023-August/NOISOYU3QTB2DGIYUBGF7CAMQHDI2QLT.html) ([guide](https://blog.centminmod.com/2023/10/03/2860/how-to-enable-cloudflare-post-quantum-x25519kyber768-key-exchange-support-in-centmin-mod-nginx/))
36+
- [Caddy HTTP server](https://caddyserver.com/) nightly [compiled with Go 1.23+](https://gist.github.com/bwesterb/2f7bfa7ae689de0d242b56ea3ecac424)
37+
- [Botan C++ library 3.2.0+](https://botan.randombit.net/) ([instructions](https://github.com/randombit/botan/discussions/3747))
38+
- ISRG's fork of [Rustls](https://www.memorysafety.org/blog/pq-key-exchange/)

src/content/docs/ssl/post-quantum-cryptography/reference.mdx

Lines changed: 0 additions & 8 deletions
This file was deleted.

0 commit comments

Comments
 (0)