The Post-Quantum Future of Web Privacy
Cloudflare, Friday, November 6th, 2026
Cloudflare examines the quantum threat to Privacy Pass and a new blind signature design called MOLE for post-quantum web privacy.
Cloudflare looks at how post-quantum migration applies beyond TLS to Privacy Pass, a protocol it uses to rate limit clients with unlinkable tokens instead of CAPTCHAs or fingerprinting.
Privacy Pass relies on RSA and elliptic curves, so a quantum attacker could forge tokens, though its privacy is unconditional and redemption cannot be linked to issuance even after Q-day.
The main obstacle is the size of post-quantum primitives, for example 2,420-byte ML-DSA-44 signatures versus 64-byte ECDSA-P256.
Cloudflare explores a recent blind signature breakthrough, MOLE (Moderation Of unLinkable Endorsements), which also hides the issuer's identity, as part of next-generation private authentication for managing agentic traffic.