Loading post…
CloudflareLina BaqueroAnnouncement
Preventing quantum downgrade attacks against IPsec
Summary
Cloudflare has identified a design flaw in IPsec that allows a quantum attacker to downgrade post-quantum-protected connections to classical cryptography. The attack exploits the fact that IKEv2 endpoints sign only their outbound messages rather than the full handshake transcript. This vulnerability requires a quantum computation in real time during the handshake, and resource estimates for such attacks have decreased, prompting Cloudflare to move its transition deadline to 2029. To mitigate this, Cloudflare worked with the IETF to develop a full transcript authentication extension for IKEv2 that prevents downgrade attacks. The extension is now available in beta for Cloudflare WAN and Magic Transit customers on an opt-in basis.
Context
The world is racing to build quantum computers that can crack classical cryptography. IPsec, a core security protocol operating at the IP layer, is vulnerable to a downgrade attack where a quantum attacker can manipulate handshake messages to make one party believe the other does not support post-quantum cryptography, thereby bypassing PQ protection. This attack requires a quantum computation in real time during the handshake, and resource estimates for quantum attacks have decreased dramatically, leading Cloudflare to move its transition deadline to 2029.
Approach / What changed
Cloudflare worked with the IETF to develop a full transcript authentication extension for IKEv2 that prevents downgrade attacks by having each party sign the entire handshake transcript rather than only its outbound messages. The extension is implemented and available in beta for Cloudflare WAN and Magic Transit customers who request the ipsec_downgrade_protection flag.
Takeaways
IPsec’s IKEv2 protocol has a design flaw where each party signs only its outbound messages, not the full handshake transcript, enabling a quantum downgrade attack.
The attack requires a quantum computation in real time during the handshake, and resource estimates for such attacks have decreased, leading Cloudflare to move its transition deadline to 2029.
Cloudflare helped the IETF develop a full transcript authentication extension for IKEv2 that prevents downgrade attacks and has made it available in beta for Cloudflare WAN and Magic Transit customers.
FAQ
How does the IPsec downgrade attack work?
The attack exploits the fact that in IKEv2 each party signs only its outbound messages, not the full handshake transcript. An on-path quantum attacker can manipulate messages to make one endpoint believe the other does not support post-quantum cryptography, downgrading the connection to classical crypto that a quantum computer can break.
How does full transcript authentication prevent downgrade?
The extension requires each party to sign the entire handshake transcript, not just its own outbound messages. This ensures both endpoints have observed the same sequence of messages, preventing an attacker from manipulating the handshake to hide PQ support.
How can customers enable this protection?
Cloudflare has rolled out beta support for the extension in Cloudflare WAN and Magic Transit. Customers can enable it by requesting their account manager turn on the ipsec_downgrade_protection flag. The feature is gated for beta testing and will be enabled for all accounts after sufficient testing.
Source and freshness
- Source
- blog.cloudflare.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.