Cloudflare has begun automatically selecting post-quantum key exchange for connections to compatible origin servers, with protected traffic reaching about 45 billion connections per day as transport layer security (TLS) handshake delays fall.

The company’s new Automatic Key Exchange capability probes origin servers to determine which cryptographic algorithms they support, then selects the strongest compatible option when establishing a TLS 1.3 connection. It prioritizes the hybrid X25519MLKEM768 post-quantum algorithm and falls back to an appropriate classical algorithm when necessary.

Cloudflare said post-quantum origin traffic among the scanned cohort increased from roughly 25 billion to 45 billion daily connections during the rollout, with Automatic Key Exchange contributing significantly to that growth. The proportion of post-quantum TLS 1.3 connections completing in a single network round trip rose from zero to 99.2%.

The feature addresses a limitation in the TLS 1.3 handshake. When initiating a connection, a client must send a cryptographic key share before the server has indicated which algorithm it prefers. If the server rejects that choice, it issues a "HelloRetryRequest" message and the client must try again, adding another network round trip.

Cloudflare previously sent the classical X25519 key share first for most origin connections because it is widely supported. Origin servers configured to prioritize X25519MLKEM768 typically had to request it through a retry, increasing latency on post-quantum connections.

That conservative approach reflected compatibility concerns around the larger post-quantum key share. An X25519MLKEM768 key share is 1,216 bytes, compared with 32 bytes for X25519, and can push the opening "ClientHello" message beyond a single network packet. Cloudflare previously found that about 0.34% of scanned origins failed to complete the handshake when sent a post-quantum key share first, with legacy servers and middleboxes among the potential causes.

Automatic Key Exchange uses out-of-band scans to test each origin’s support for X25519MLKEM768 and several classical algorithms. Cloudflare then gradually deploys the selected preference while monitoring connection failures and retry rates. Origins are rescanned daily to account for infrastructure or configuration changes.

Cloudflare said active probing also identifies capabilities that cannot be inferred from existing traffic. Some post-quantum-capable origins accept a classical X25519 key share without requesting a stronger alternative, leaving that support invisible to passive monitoring. The company is currently assigning a non-X25519 preference to about 9,000 additional domains per day, nearly all of which are moving directly to post-quantum key exchange.

Across the origins scanned so far, the proportion of connections requiring a HelloRetryRequest fell from about 52% to 3.7%, reducing 90th-percentile handshake latency by more than 150 milliseconds, Cloudflare reported.

The company has assigned key exchange preferences to more than one million domains as deployment continues. About 33% were assigned X25519MLKEM768, 64% remained on X25519, and the remainder were assigned another classical curve supported by their origin infrastructure.

Automatic Key Exchange is enabled by default for new and existing Cloudflare domains whose origins support TLS 1.3. However, post-quantum protection still depends on the underlying origin supporting X25519MLKEM768. Cloudflare estimates that more than 12% of individual origins across its network currently support post-quantum key exchange.

Cloudflare is also developing more granular per-origin selection, on-demand compatibility scans, and automatic detection of post-quantum authentication using ML-DSA certificates.