Cloudflare Workers adds post-quantum crypto primitives

Cloudflare Workers now supports post-quantum cryptographic algorithms through its Web Crypto API, allowing developers to test quantum-resistant key encapsulation and digital signatures without relying on external libraries. The update introduces ML-KEM and ML-DSA primitives, which are part of a draft specification for modern cryptographic operations in web environments. These additions are available behind a compatibility flag while the underlying standards evolve.

What’s included

The implementation covers two core post-quantum algorithms: ML-KEM for key encapsulation and ML-DSA for digital signatures. Workers now supports ML-KEM-768 and ML-KEM-1024 for key exchange, alongside ML-DSA-44, ML-DSA-65, and ML-DSA-87 for signing operations. The runtime also includes helper functions like getPublicKey(), which simplifies deriving public keys from private keys, and SubtleCrypto.supports(), which lets applications check for algorithm availability at runtime.

Developers must enable the webcrypto_modern_algorithms flag in their wrangler.jsonc configuration to access these features. The update does not include ML-KEM-512, as the underlying BoringSSL library used by Workers does not expose it. Cloudflare has also added Web Platform Tests and TypeScript definitions to ensure compatibility with the draft specification.

How developers can use it

The new APIs allow developers to generate key pairs, encapsulate shared secrets, and sign or verify data using ML-KEM and ML-DSA. For example, ML-KEM can be used to establish shared key material between two parties, which can then be fed into protocols like Hybrid Public Key Encryption (HPKE) for secure communication. ML-DSA, meanwhile, functions similarly to existing signature schemes like Ed25519 or ECDSA, enabling developers to sign and verify data with quantum-resistant algorithms.

Libraries such as panva/jose and panva/hpke can now delegate these operations to the Workers runtime instead of bundling their own implementations. This reduces application size and simplifies maintenance, as developers no longer need to manage cryptographic code across different environments. However, the APIs are not yet stable and remain opt-in, meaning libraries must still check for support before using them.

Limitations and trade-offs

While the integration improves performance and reduces the need for external cryptographic libraries, it does not address the larger size of post-quantum keys and signatures. ML-DSA public keys and signatures are significantly larger than those used in RSA or Ed25519, which could impact storage and bandwidth requirements. Additionally, the APIs are currently behind a compatibility flag, reflecting their draft status and the need for further feedback from the developer community.

Cloudflare has not yet implemented other algorithms from the broader Web Crypto modern algorithms proposal, such as SHA-3, cSHAKE, TurboSHAKE, or ChaCha20-Poly1305. These may be added in future updates, depending on community demand and specification stability.

Why this matters

The addition of post-quantum primitives to Workers provides developers with a low-friction way to experiment with quantum-resistant cryptography. This is particularly relevant for applications that need to future-proof their security, such as those handling long-term sensitive data or operating in regulated industries. By integrating these algorithms into Web Crypto, Cloudflare reduces the barrier to entry for developers who would otherwise need to bundle and maintain their own implementations.

What’s next

Cloudflare plans to gather feedback from library authors and developers before making these APIs stable and enabled by default. The company has also indicated that further algorithms from the Web Crypto modern algorithms proposal may be implemented in future updates, depending on community interest and specification progress. For now, developers are encouraged to experiment with the new primitives and report any issues or limitations they encounter.