Cloudflare has announced plans to make its entire web infrastructure platform resistant to quantum computing attacks by 2029, with a particular focus on post-quantum authentication. The company outlined its roadmap in a blog post published Tuesday, warning that compromised authentication keys could enable attackers to impersonate servers, gain unauthorised system access, or push malicious software updates. The accelerated timeline reflects mounting concern across the technology industry about the pace of quantum computing development.
Sharon Goldberg, senior director of product management at Cloudflare, explained that upgrading authentication is more involved than upgrading encryption. While post-quantum encryption upgrades to Transport Layer Security, the cryptographic protocol that secures internet connections between clients and servers, require only changes to the client and server, authentication involves additional steps. Goldberg said the company’s decision to speed up its roadmap was driven by recent breakthroughs in quantum computing and by Google setting its own 2029 target for a full rollout of post-quantum authentication.
The broader industry concern centres on what researchers call Q-Day, the theoretical point at which a practical quantum computer becomes capable of breaking current cryptographic standards. While experts once considered Q-Day to be decades away, recent research from companies including IBM and Google has moved that estimate closer to 2032. Goldberg cautioned that after Q-Day, any system lacking post-quantum authentication could be vulnerable to an adversary equipped with a sufficiently powerful quantum machine.
The implications extend well beyond web infrastructure. Bitcoin relies on elliptic-curve digital signatures to verify coin ownership and authorise transactions. Prominent figures in the cryptocurrency space, including Ethereum co-founder Vitalik Buterin, Solana co-founder Anatoly Yakovenko, and Cardano founder Charles Hoskinson, have warned that a powerful enough quantum computer running Shor’s algorithm could theoretically derive a private key from a public key, making a transition to post-quantum algorithms necessary before Q-Day arrives.
A study published in March by researchers at Caltech and Oratomic suggested that breaking Bitcoin’s cryptography could be achieved with as few as 10,000 qubits using a neutral-atom quantum computer. However, experts caution that reaching that qubit count in a functional, reliable system is far from straightforward. Oratomic co-founder and CEO Dolev Bluvstein noted that simply having 10,000 physical qubits is not the true benchmark, describing the engineering challenge of building such a machine as highly complex and non-trivial.
Cloudflare noted that it began addressing part of this risk in 2022 by enabling post-quantum encryption across most of its products. The company reports that over 65 percent of human traffic reaching its platform is now post-quantum encrypted, and the majority of its products support post-quantum encryption. Despite that progress, Goldberg emphasised that the work remains incomplete until post-quantum authentication is also fully deployed.
The company’s phased rollout plan calls for post-quantum authentication for origin connections in mid-2026, followed by visitor connections in mid-2027, expansion across its enterprise networking platform by early 2028, and full deployment across all services by 2029. Goldberg urged other organisations to begin acting with urgency, warning that the complexity of the upgrade means there is limited time to implement a safe and orderly transition before Q-Day potentially arrives.
Originally reported by Decrypt.
