cPanel Forums

This post is also available in 简体中文, 日本語, Deutsch, Français and Español.

Undoubtedly, one of the big themes in IT for the next decade will be the migration to post-quantum cryptography. From tech giants to small businesses: we will all have to make sure our hardware and software is updated so that our data is protected against the arrival of quantum computers. It seems far away, but it’s not a problem for later: any encrypted data captured today (not protected by post-quantum cryptography) can be broken by a sufficiently powerful quantum computer in the future.

Luckily we’re almost there: after a tremendous worldwide effort by the cryptographic community, we know what will be the gold standard of post-quantum cryptography for the next decades. Release date: somewhere in 2024. Hopefully, for most, the transition will be a simple software update then, but it will not be that simple for everyone: not all software is maintained, and it could well be that hardware needs an upgrade as well. Taking a step back, many companies don’t even have a full list of all software ruing on their network.

For Cloudflare Tuel customers, this migration will be much simpler: introducing Post-Quantum Cloudflare Tuel. In this blog post, first we give an overview of how Cloudflare Tuel works and explain how it can help you with your post-quantum migration. Then we’ll explain how to get started and finish with the nitty-gritty technical details.

Cloudflare Tuel

With Cloudflare Tuel you can securely expose a server sitting within an internal network to the Internet by ruing the cloudflared service next to it. For instance, after having installed cloudflared on your internal network, you can expose your on-prem webapp on the Internet under, say example.com, so that remote workers can access it from anywhere,

How does it work? cloudflared creates long-ruing coections to two nearby Cloudflare data centers, for instance San Francisco (coection 3) and one other. When your employee visits your domain, they coect (1) to a Cloudflare server close to them, say in Frankfurt. That server knows that this is a Cloudflare Tuel and that your cloudflared has a coection to a server in San Francisco, and thus it relays (2) the request to it. In turn, via the reverse coection, the request ends up at cloudflared, which passes it (4) to the webapp via your internal network.

In essence, Cloudflare Tuel is a simple but convenient tool, but the magic is in what you can do on top with it: you get Cloudflare’s DDoS protection for free; fine-grained access control with Cloudflare Access (even if the application didn’t support it) and request logs just to name a few. And let’s not forget the matter at hand:

Post-quantum tuels

Our goal is to make it easy for everyone to have a fully post-quantum secure coection from users to origin. For this, Post-Quantum Cloudflare Tuel is a powerful tool, because with it, your users can benefit from a post-quantum secure coection without upgrading your application (coection 4 in the diagram).

Today, we make two important steps towards this goal: cloudflared 2022.9.1 adds the --post-quantum flag, that when given, makes the coection from cloudflared to our network (coection 3) post-quantum secure.

Also today, we have aounced support for post-quantum browser coections (coection 1).

We aren’t there yet: browsers (and other HTTP clients) do not support the post-quantum security offered by our network, yet, and we still have to make the coections between our data centers (coection 2) post-quantum secure.

An attacker only needs to have access to one vulnerable coection, but attackers don’t have access everywhere: with every coection we make post-quantum secure, we remove one opportunity for compromise.

We are eager to make post-quantum tuels the default, but for now it is a beta feature. The reason is that the cryptography used and its integration into the network protocol are not yet final. Making post-quantum the default now, would require users to update cloudflared more often than we can reasonably expect them to.

Getting started

Are frequent updates to cloudflared not a problem for you? Then please do give post-quantum Cloudflare Tuel a try. Make sure you’re on at least 2022.9.1 and simply run cloudflared with the --post-quantum flag:

$ cloudflared tuel run --post-quantum tuel-name
2022-09-23T11:44:42Z INF Starting tuel tuelID=[...]
2022-09-23T11:44:42Z INF Version 2022.9.1
2022-09-23T11:44:42Z INF GOOS: darwin, GOVersion: go1.19.1, GoArch: amd64
2022-09-23T11:44:42Z INF Settings: map[post-quantum:true pq:true]
2022-09-23T11:44:42Z INF Generated Coector ID: [...]
2022-09-23T11:44:42Z INF cloudflared will not automatically update if installed by a package manager.
2022-09-23T11:44:42Z INF Initial protocol quic
2022-09-23T11:44:42Z INF Using experimental hybrid post-quantum key agreement X25519Kyber768Draft00
2022-09-23T11:44:42Z INF Starting metrics server on 127.0.0.1:53533/metrics
2022-09-23T11:44:42Z INF Coection [...] registered coIndex=0 ip=[...] location=AMS
2022-09-23T11:44:43Z INF Coection [...] registered coIndex=1 ip=[...] location=AMS
2022-09-23T11:44:44Z INF Coection [...] registered coIndex=2 ip=[...] location=AMS
2022-09-23T11:44:45Z INF Coection [...] registered coIndex=3 ip=[...] location=AMS

If you run cloudflared as a service, you can turn on post-quantum by adding post-quantum: true to the tuel configuration file. Conveniently, the cloudflared service will automatically update itself if not installed by a package manager.

If, for some reason, creating a post-quantum tuel fails, you’ll see an error message like

2022-09-22T17:30:39Z INF Starting tuel tuelID=[...]
2022-09-22T17:30:39Z INF Version 2022.9.1
2022-09-22T17:30:39Z INF GOOS: darwin, GOVersion: go1.19.1, GoArch: amd64
2022-09-22T17:30:39Z INF Settings: map[post-quantum:true pq:true]
2022-09-22T17:30:39Z INF Generated Coector ID: [...]
2022-09-22T17:30:39Z INF cloudflared will not automatically update if installed by a package manager.
2022-09-22T17:30:39Z INF Initial protocol quic
2022-09-22T17:30:39Z INF Using experimental hybrid post-quantum key agreement X25519Kyber512Draft00
2022-09-22T17:30:39Z INF Starting metrics server on 127.0.0.1:55889/metrics
2022-09-22T17:30:39Z INF 

===================================================================================
You are hitting an error while using the experimental post-quantum tuels feature.

Please check:

   https://pqtuels.cloudflareresearch.com

for known problems.
===================================================================================


2022-09-22T17:30:39Z ERR Failed to create new quic coection error="failed to dial to edge with quic: CRYPTO_ERROR (0x128): tls: handshake failure" coIndex=0 ip=[...]

When the post-quantum flag is given, cloudflared will not fall back to a non post-quantum coection.

What to look for

The setup phase is the crucial part: once established, the tuel is the same as a normal tuel. That means that performance and reliability should be identical once the tuel is established.

The post-quantum cryptography we use is very fast, but requires roughly a kilobyte of extra data to be exchanged during the handshake. The difference will be hard to notice in practice.

Our biggest concern is that some network equipment/middleboxes might be confused by the bigger handshake. If the post-quantum Cloudflare Tuel isn’t working for you, we’d love to hear about it. Contact us at [email protected] and tell us which middleboxes or ISP you’re using.

Under the hood

When the --post-quantum flag is given, cloudflared restricts itself to the QUIC transport for the tuel coection to our network and will only allow the post-quantum hybrid key exchanges X25519Kyber512Draft00 and X25519Kyber768Draft00 with TLS identifiers 0xfe30 and 0xfe31 respectively. These are hybrid key exchanges between the classical X25519 and the post-quantum secure Kyber. Thus, on the off-chance that Kyber turns out to be insecure, we can still rely on the non-post quantum security of X25519. These are the same key exchanges supported on our network.

cloudflared randomly picks one of these two key exchanges. The reason is that the latter usually requires two initial packets for the TLS ClientHello whereas the former only requires one. That allows us to test whether a fragmented ClientHello causes trouble.

When cloudflared fails to set up the post-quantum coection, it will report the attempted key exchange, cloudflared version and error to pqtuels.cloudflareresearch.com so that we have visibility into network issues. Have a look at that page for updates on our post-quantum tuel deployment.

The control coection and authentication of the tuel between cloudflared and our network are not post-quantum secure yet. This is less urgent than the store-now-decrypt-later issue of the data on the tuel itself.

We have open-sourced support for these post-quantum QUIC key exchanges in Go.

Outlook

In the coming decade the industry will roll out post-quantum data protection. Some cases will be as simple as a software update and others will be much more difficult. Post-Quantum Cloudflare Tuel will secure the coection between Cloudflare’s network and your origin in a simple and user-friendly way — an important step towards the Post-Quantum Internet, so that everyone may continue to enjoy a private and secure Internet.