---
title: "Using AI to chart a course for our post-quantum migration"
description: "Cloudflare is racing toward a 2029 deadline for full post-quantum readiness, having already upgraded many products to post-quantum encryption but still needing to address authentication and remaining classical cryptography. To manage this massive migration, they built CryptoLabe, an internal AI-powered tool that scans their centralized codebase to discover and classify cryptography usage. The tool operates in two stages: discovery finds raw observations of cryptography across source, configuration, manifests, lockfiles, scripts, tests, and documentation, then analysis re-checks each observation, investigates runtime use and dependencies, and assigns classifications such as classical encryption, signature, or token. CryptoLabe also surfaces prerequisites where PQ migration is blocked by missing standards or library support, enabling Cloudflare to work with standards bodies and ecosystem stakeholders to drive migration plans. The post shares learnings for other organizations, recommending starting with a single repository, validating results, and prioritizing high-impact systems."
---

# Using AI to chart a course for our post-quantum migration

[Cloudflare](https://yomu.fyi/company/cloudflare) · Tiago Silva · Sep 29, 2026

**Type:** Explainer

## Summary

Cloudflare is racing toward a 2029 deadline for full post-quantum readiness, having already upgraded many products to post-quantum encryption but still needing to address authentication and remaining classical cryptography. To manage this massive migration, they built CryptoLabe, an internal AI-powered tool that scans their centralized codebase to discover and classify cryptography usage. The tool operates in two stages: discovery finds raw observations of cryptography across source, configuration, manifests, lockfiles, scripts, tests, and documentation, then analysis re-checks each observation, investigates runtime use and dependencies, and assigns classifications such as classical encryption, signature, or token. CryptoLabe also surfaces prerequisites where PQ migration is blocked by missing standards or library support, enabling Cloudflare to work with standards bodies and ecosystem stakeholders to drive migration plans. The post shares learnings for other organizations, recommending starting with a single repository, validating results, and prioritizing high-impact systems.

## Context

Cloudflare is working toward full post-quantum readiness by 2029, having already upgraded many products to post-quantum encryption. They built an internal AI-powered tool called CryptoLabe to discover cryptography across their codebase and plan the migration.

## Approach / What changed

CryptoLabe uses a two-stage AI-powered scan: discovery finds raw observations of cryptography across source, configuration, manifests, lockfiles, scripts, tests, and documentation; analysis re-checks each observation, investigates runtime use and dependencies, and assigns classifications such as classical encryption, signature, or token. It also surfaces prerequisites where PQ migration is blocked by missing standards or library support.

## Takeaways

- CryptoLabe uses a two-stage process: discovery finds raw observations of cryptography across the codebase, then analysis re-checks each observation, investigates runtime use, and assigns classifications to avoid overcounting or undercounting from simple grep.
- The tool surfaces prerequisites where post-quantum migration is blocked by missing standards or library support, allowing Cloudflare to proactively work with standards bodies and ecosystem stakeholders.
- The post recommends starting with a single customer-facing repository, validating results with the owning team, and prioritizing high-impact systems rather than requiring a complete map of every cryptographic operation.

## FAQ

### How does CryptoLabe avoid overcounting cryptography from unused code?

CryptoLabe uses a two-stage analysis that re-checks observations against source code, investigates runtime use, and checks for configuration overrides, test-only code, or incorrect assumptions. When evidence is insufficient, it assigns 'More evidence needed' rather than guessing.

### What classifications does CryptoLabe assign to cryptography findings?

It assigns classifications such as classical encryption, classical signature, classical token, and others. These are catch-all categories that may be refined later, for example splitting encryption into key agreement and HPKE.

### What should other organizations do first for their PQ migration?

Start with a single repository that is customer-facing or on the public Internet, run cryptography discovery, validate results with the owning team, and prioritize high-impact systems and prerequisites. This gives the beginning of a PQ transition plan without requiring a complete map.

**Tags:** [AI](https://yomu.fyi/topic/ai), [Cryptography](https://yomu.fyi/topic/cryptography), [Migrations](https://yomu.fyi/topic/migration), [Post-Quantum Cryptography](https://yomu.fyi/topic/post-quantum)

- Source: [Cloudflare](https://blog.cloudflare.com/ai-driven-cryptography-discovery)
- Source URL: https://blog.cloudflare.com/ai-driven-cryptography-discovery
- Ingested by Yomu: 2026-09-29T15:00:17.172Z

[Read original post](https://blog.cloudflare.com/ai-driven-cryptography-discovery)