Cloudflare has added opt-in support for post-quantum cryptographic primitives to the Web Crypto implementation in Cloudflare Workers. Available behind a new compatibility flag, the update lets developers and library maintainers experiment with post-quantum security mechanisms directly within the runtime environment without bundling external JavaScript or WebAssembly cryptographic libraries.
Native Primitives for ML-KEM and ML-DSA
The update introduces key encapsulation mechanisms ML-KEM-768 and ML-KEM-1024 alongside digital signature algorithms ML-DSA-44, ML-DSA-65, and ML-DSA-87. Cloudflare omitted ML-KEM-512 because the underlying BoringSSL library used by the Workers runtime workerd does not expose it.
In addition to core cryptographic primitives, Cloudflare implemented new helper methods specified in the Modern Algorithms draft report for the Web Cryptography API. These additions include getPublicKey(), SubtleCrypto.supports(), encapsulateBits(), decapsulateBits(), encapsulateKey(), decapsulateKey(), and JSON Web Key (JWK) import and export capabilities for the supported algorithms.
Runtime Infrastructure and Ecosystem Integration
Built on top of BoringSSL inside the open-source workerd runtime, native exposure of these algorithms allows higher-level libraries such as JOSE and HPKE implementations to delegate heavy signature and encapsulation operations to the runtime. This approach reduces application bundle sizes for edge workloads. However, Cloudflare noted that using post-quantum algorithms increases the size of public keys, signatures, and ciphertexts transmitted on the wire or retained in storage compared to traditional algorithms like RSA or Ed25519.
Activation and Limitations
Developers can enable the experimental features by adding the webcrypto_modern_algorithms compatibility flag to their Wrangler configuration file. Other cryptographic features outlined in the broader W3C Web Incubator Community Group proposal—such as SHA-3, ChaCha20-Poly1305, cSHAKE, TurboSHAKE, and native HPKE—are not included in this release and remain subject to future review.
AI-generated editorial illustration; not a documentary photograph.
Source: Support for modern cryptographic algorithms in Workers
SIGNAL TITANS
Leave a Reply