Cloudflare AKE Reduces p90 Handshake Latency for Scanned Origin Connections by Over 150ms

Cloudflare has announced the Automatic Key Exchange (AKE) feature, introducing a method to apply the appropriate Key Agreement Algorithm from the first attempt during TLS 1.3 origin connections. The previous method used X25519 for the initial key share, requiring an additional round trip via HelloRetryRequest (HRR) to switch to a Post-Quantum (PQ) connection. AKE reduces this latency by using pre-probing to identify the algorithms supported by the origin.

How AKE Works and Its Impact

AKE performs lightweight TLS handshakes repeatedly outside the production traffic path to identify the set of algorithms supported by each origin. It then attempts connections with X25519MLKEM768 (PQ Hybrid) as the highest priority, followed by classical curves (such as X25519 and P-256).

• Latency Reduction: For origin connections to scanned domains, the HRR rate decreased from approximately 52% to 3.7%, and p90 handshake latency was reduced by over 150ms.
• Expanded PQ Connections: Currently, 99.2% of PQ TLS 1.3 connections in the scanned origin set complete in a single round trip. PQ origin traffic in this set increased from 25 billion connections per day to 45 billion connections, with AKE's PQ-priority connection switching contributing significantly to this increase.
• Support Status: The percentage of origins supporting PQ key exchange algorithms has increased from 0.5% to 12.8% since 2023. Independent of this change in support rates, approximately 33% of the initially scanned domain set prioritized X25519MLKEM768.

Security Policy and Future Roadmap

AKE has been automated to prepare for 'harvest-now, decrypt-later' attacks and Q-Day. Cloudflare aims to make security features free, automatic, and enabled by default, manageable via a toggle in the Dashboard.

• Caution: If an origin does not support X25519MLKEM768 key exchange but PQ Hybrid is forcibly configured, TLS 1.3 connections may fail entirely due to the lack of mutually supported algorithms. Therefore, negotiation occurs flexibly based on origin support.
• Future Plans: Cloudflare plans to further granularize domain-level decisions and automatically detect PQ authentication support on origins. ML-DSA certificates were already introduced this year for Authenticated Origin Pulls and Custom Origin Trust Stores. In the future, if scanners confirm PQ authentication support, the system will automatically disable classical fallback for customers seeking strict PQ protection, thereby reducing downgrade risks.