#+HashtagPLUS
In

Menu

Post image 1
Post image 2
Post image 3
Post image 4
Post image 5
Post image 6
Post image 7
Post image 8
Post image 9
Post image 10
Post image 11
Post image 12
Post image 13
Post image 14
Post image 15
Post image 16
Post image 17
Post image 18
Post image 19
Post image 20
Post image 21
Post image 22
Post image 23
1 / 23
0

Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)

Hacker News·24 days ago
#eFm4vql1
#tls#cloudflare#handshake#x25519mlkem768#article#ama
Reading 0:00
15s threshold

Every time Cloudflare opens a new TLS 1.3 connection to an origin server, we have to make a guess: the protocol requires us to commit to a key agreement algorithm in the very first packet we send, before the origin has told us anything about itself or what it can support. If we guess right, the handshake completes in one round trip. Guess wrong, and the origin replies with a HelloRetryRequest , we start over, and the connection costs two round trips. For years, our guess was the same for every origin on the Internet: X25519 . Widely supported, but as it turns out, suboptimal for roughly 30% of the origin connections we've since measured. Today we're announcing Automatic Key Exchange , an extension of Automatic SSL/TLS that replaces the guess with a measurement.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.

Create free accountLog in
Read More