Cloudflare explores post-quantum privacy with MOLE and PoMFRIT

Cloudflare says authenticated key agreement such as TLS is the highest priority for post-quantum cryptography, but web privacy also depends on Privacy Pass. Privacy Pass is unconditionally private, yet it still relies on classical cryptography such as RSA and elliptic curves, so a quantum attacker could forge tokens and bypass site security controls. The company says new private authentication capabilities it is developing will keep interactions private even after Q-day, but an alternative will be needed soon.

Privacy Pass and post-quantum pressure

Privacy Pass lets a client receive unlinkable tokens and redeem them for access, helping site operators rate-limit clients without CAPTCHAs or fingerprinting. Cloudflare and others are collaborating on the next generation of this technology to manage agentic traffic and open participation to more client types. The company notes that ML-DSA-44 signatures are 2,420 bytes while ECDSA-P256 signatures are 64 bytes, and that drop-in post-quantum replacements are not expected soon.

MOLE and issuer-hiding endorsements

MOLE, short for Moderation Of unLinkable Endorsements, is a proposed system where an anchor issues an endorsement and a moderator redeems it. Before redemption, the client and moderator agree on an anchor set of trusted public keys. During redemption, the client proves it was issued an endorsement by one anchor in that set without revealing which one, and the moderator then issues a MOLE credential. MOLE credentials can be instantiated with blind signatures, anonymous credit tokens, or anonymous rate-limited credentials.

VOLE-in-the-Head and multivariate signatures

VOLE-in-the-Head is a zero-knowledge proof system from Baum et al. at Crypto 2023 that turns interactive VOLE into a non-interactive proof using the Fiat-Shamir transformation. It is efficient for statements expressed as equations over small binary fields, with FAEST proofs around 4KB and KuMQuat signatures as small as 2.6KB. UOV signatures are 135 bytes with 46.6KB public keys, while MAYO has smaller public keys and slightly larger signatures; both fit VOLE-in-the-Head because their arithmetic complexity is comparable to an MQ instance.

PoMFRIT and size optimizations

PoMFRIT is a blind signature from Baum et al. at USENIX Security 2026 based on VOLE-in-the-Head and MAYO, with a 6.7KB blind signature and a few hundred bytes for issuance. Swapping MAYO for UOV can reduce the signature to 4.3KB using NIST round 3 parameters for UOV and FAEST-EM-128s. The construction requires two Keccak permutations, and optimizations can reduce hashing by having the issuer compute one hash directly, though this changes the security posture and relies on a one-more-UOV assumption. TurboSHAKE uses 12 rounds instead of 24 and can reduce proof size, while reducing Keccak state size can also help.

Sources: Cloudflare