Loading post…
CloudflareTiago SilvaExplainer
Using AI to chart a course for our post-quantum migration
Summary
Cloudflare is racing toward a 2029 deadline for full post-quantum readiness, having already upgraded many products to post-quantum encryption but still needing to address authentication and remaining classical cryptography. To manage this massive migration, they built CryptoLabe, an internal AI-powered tool that scans their centralized codebase to discover and classify cryptography usage. The tool operates in two stages: discovery finds raw observations of cryptography across source, configuration, manifests, lockfiles, scripts, tests, and documentation, then analysis re-checks each observation, investigates runtime use and dependencies, and assigns classifications such as classical encryption, signature, or token. CryptoLabe also surfaces prerequisites where PQ migration is blocked by missing standards or library support, enabling Cloudflare to work with standards bodies and ecosystem stakeholders to drive migration plans. The post shares learnings for other organizations, recommending starting with a single repository, validating results, and prioritizing high-impact systems.
Context
Cloudflare is working toward full post-quantum readiness by 2029, having already upgraded many products to post-quantum encryption. They built an internal AI-powered tool called CryptoLabe to discover cryptography across their codebase and plan the migration.
Approach / What changed
CryptoLabe uses a two-stage AI-powered scan: discovery finds raw observations of cryptography across source, configuration, manifests, lockfiles, scripts, tests, and documentation; analysis re-checks each observation, investigates runtime use and dependencies, and assigns classifications such as classical encryption, signature, or token. It also surfaces prerequisites where PQ migration is blocked by missing standards or library support.
Takeaways
CryptoLabe uses a two-stage process: discovery finds raw observations of cryptography across the codebase, then analysis re-checks each observation, investigates runtime use, and assigns classifications to avoid overcounting or undercounting from simple grep.
The tool surfaces prerequisites where post-quantum migration is blocked by missing standards or library support, allowing Cloudflare to proactively work with standards bodies and ecosystem stakeholders.
The post recommends starting with a single customer-facing repository, validating results with the owning team, and prioritizing high-impact systems rather than requiring a complete map of every cryptographic operation.
FAQ
How does CryptoLabe avoid overcounting cryptography from unused code?
CryptoLabe uses a two-stage analysis that re-checks observations against source code, investigates runtime use, and checks for configuration overrides, test-only code, or incorrect assumptions. When evidence is insufficient, it assigns 'More evidence needed' rather than guessing.
What classifications does CryptoLabe assign to cryptography findings?
It assigns classifications such as classical encryption, classical signature, classical token, and others. These are catch-all categories that may be refined later, for example splitting encryption into key agreement and HPKE.
What should other organizations do first for their PQ migration?
Start with a single repository that is customer-facing or on the public Internet, run cryptography discovery, validate results with the owning team, and prioritize high-impact systems and prerequisites. This gives the beginning of a PQ transition plan without requiring a complete map.
Source and freshness
- Source
- blog.cloudflare.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.