Lessons Learned from Testing Millions of Servers for Post-Quantum Compatibility
summary
Cloudflare-run scans and a large-scale web study test post-quantum TLS hybrids using a BoringSSL fork and Cloud Radar, finding 34% origin servers break when negotiating post-quantum key shares, key-share sizes jump from 32 bytes (x25519) to ~1 KB (mlam768) causing fragmentation, and a tiny but critical subset — 0.02% fail on fragmented ClientHello — refuses reassembled handshakes; hello-retry handling is buggy on 0.32% broken HelloRetryRequest servers, certificate chains >10 KB cause widespread failures and each added KB slows median handshakes ~1.5%.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:50Post-quantum migration overview
- 3:56Key agreements vs signatures in TLS
- 8:10Post-quantum TLS challenges
- 11:23Large key shares and client hello fragmentation
- 15:59Protocol extensibility and GREASE
- 18:30Non-compliant TLS implementations
- 22:23Post-quantum testing complexities
- 25:31Performance impact of PQ signatures
- 26:57Stress testing hidden flaws
- 28:21Key takeaways and recommendations
- 29:23Q&A
related talks
28mBirth of the Post-Quantum Internet
27mPost-Quantum Cryptography
27mTurning Quantum Threats into Opportunities: Modernizing WebPKI with QUIC and Metrics-Driven Insights
30mPreparing Vulnerability Management for the Post-Quantum Era: From Legacy Cryptography Crypto-Agility
30mCoping with post-quantum signatures in the WebPKI
01h 05mChallenges and Opportunities from Quantum-Safe Cryptography
05mPost-Quantum DevOps
05mLightning Talk: Building Quantum-Safe Applications