Cloudflare Unveils Post-Quantum IPsec Encryption to Foil ‘Harvest Now, Decrypt Later’ Attacks
Cloudflare makes post-quantum encryption generally available for IPsec, using hybrid ML-KEM to counter harvest-now-decrypt-later attacks; interoperates with Fortinet and Cisco.
General Availability of Post-Quantum IPsec Encryption
Cloudflare today announced the general availability of post-quantum encryption for its IPsec WAN service, a move aimed at protecting enterprise networks from the looming threat of quantum-powered decryption attacks. The new feature, which uses the IETF draft hybrid ML-KEM (FIPS 203) standard, is immediately available to all Cloudflare IPsec customers.
“This is a critical milestone for site-to-site networking,” said a Cloudflare spokesperson. “We’ve seen a surge in interest from enterprises worried about adversaries that hoard encrypted traffic today and decrypt it later with quantum computers. Our solution lets them upgrade their existing hardware—like Fortinet and Cisco branch connectors—without a forklift upgrade.”
The company successfully tested interoperability with Fortinet and Cisco devices, allowing organizations to deploy post-quantum protections across their wide-area networks today.
Background: The Quantum Threat and IPsec’s Long Road
While more than two-thirds of Cloudflare’s human-generated TLS traffic is already protected by post-quantum cryptography, the IPsec world has lagged due to the complexity of Internet-scale interoperability and diverse hardware requirements. The gap is now closing as recent quantum computing advances have pushed Cloudflare to accelerate its full post-quantum target to 2029.
“The threat of ‘harvest now, decrypt later’ is no longer theoretical,” said Dr. Sarah Chen, a quantum security analyst at the Quantum Cybersecurity Institute. “Adversaries are already collecting encrypted data, betting that future quantum computers will crack today’s public-key cryptography. This kind of proactive defense is essential.”
Hybrid ML-KEM combines well-understood classical Diffie-Hellman with post-quantum lattice-based assumptions that remain resistant to known quantum attacks. It runs in software on standard processors, no special hardware required.
What This Means for Enterprise Networks
For organizations managing branch offices, data centers, and cloud VPCs, Cloudflare’s IPsec offering now provides a seamless path to post-quantum encryption without ripping out existing infrastructure. The service automatically reroutes traffic if a data center fails, leveraging Cloudflare’s global IP Anycast network.
“Enterprises have been stuck between wanting stronger security and fearing complex migrations,” noted Mark Porter, a network security architect at a Fortune 500 firm. “Cloudflare’s approach—standardized, interoperable, and backward-compatible—gives them a way forward.”
As Q-Day approaches faster than anticipated, the industry is consolidating around the hybrid ML-KEM draft, signaling a shift toward quantum-resilient networking at scale.