Cloudflare Inc. today announced that it’s accelerating its post-quantum security roadmap and is now aiming to make its entire platform fully post-quantum-secure by 2029, including authentication systems.

The updated timeline follows new developments in quantum computing research that suggest current cryptographic standards could be broken sooner than previously expected.

The decision by Cloudflare to move its post-quantum security roadmap forward comes after Google LLC and research from Oratomic demonstrated significant advances in algorithms and hardware capable of breaking widely used encryption methods such as RSA-2048 and elliptic curve cryptography.

Cloudflare believes that these developments are bringing forward the potential arrival of “Q-day,” when quantum computers can break current encryption systems. Some projections now place that milestone as early as the end of the decade, narrowing the window for organizations to transition to quantum-resistant security models.

The company said progress across three key areas — quantum hardware, error correction and quantum algorithms — is advancing in parallel and compounding overall capability. Improvements in areas such as neutral atom architectures and more efficient error correction are reducing the resources required to break encryption, while algorithmic advances are lowering computational complexity.

Until now, much of the industry focus has been on protecting encrypted data from so-called harvest now, decrypt later attacks, where adversaries collect encrypted data today ahead of future decryption. Cloudflare said that now that timelines are shortening, the greater risk shifts to authentication, where quantum-enabled attackers could forge credentials and gain direct access to systems.

The ability to compromise authentication systems would allow attackers to bypass defenses entirely and partake in activities such as unauthorized access, data exfiltration or system disruption.

Migrating to post-quantum authentication isn’t that easy, however, with Cloudflare saying that it’s more complex than deploying post-quantum encryption given dependencies on long-lived keys, third-party systems and certificate infrastructure.

Added to the mix is that adopting post-quantum cryptography alone is not sufficient, as legacy cryptographic systems must be disabled to prevent downgrade attacks. Previously exposed credentials and secrets must be rotated once quantum-vulnerable systems are phased out.

Cloudflare has already deployed post-quantum encryption across a large portion of its network and reports that more than half of human traffic it processes now uses post-quantum key agreement. The company plans to expand support for post-quantum authentication in 2026, followed by broader deployment across its network and products through 2028.

By 2029, Cloudflare said, it expects all of its services to be fully post-quantum secure, with those services being available by default across its platform, without requiring customer action or additional cost as part of the company’s commitment to security upgrades.

Image: SiliconANGLE/Ideogram