---
title: "IPsec"
description: "1 posts about IPsec, summarised, each linking to the original."
---

# IPsec
> 1 posts about IPsec, summarised, each linking to the original.

## Articles

### [Preventing quantum downgrade attacks against IPsec](https://yomu.fyi/post/preventing-quantum-downgrade-attacks-against-ipsec.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Lina Baquero
- Published: Sep 29, 2026
- Type: Announcement

Cloudflare has identified a design flaw in IPsec that allows a quantum attacker to downgrade post-quantum-protected connections to classical cryptography. The attack exploits the fact that IKEv2 endpoints sign only their outbound messages rather than the full handshake transcript. This vulnerability requires a quantum computation in real time during the handshake, and resource estimates for such attacks have decreased, prompting Cloudflare to move its transition deadline to 2029. To mitigate this, Cloudflare worked with the IETF to develop a full transcript authentication extension for IKEv2 that prevents downgrade attacks. The extension is now available in beta for Cloudflare WAN and Magic Transit customers on an opt-in basis.