Cloudflare's Automatic Key Exchange: Smarter TLS Handshakes for Origins

Cloudflare has rolled out Automatic Key Exchange, a feature that eliminates the guesswork in TLS 1.3 handshakes with origin servers. Instead of always leading with X25519, Cloudflare now probes each origin to learn its preferred key agreement algorithm, then uses that algorithm in the initial ClientHello. This reduces HelloRetryRequests (HRRs) from roughly 52% to 3.7%, cutting p90 handshake latency by more than 150 ms.

The feature extends Automatic SSL/TLS, which already scans origins to determine their TLS capabilities. Automatic Key Exchange uses the same scanning pipeline to map which key agreement algorithms each origin supports, including post-quantum options like X25519MLKEM768. This allows Cloudflare to lead with a post-quantum keyshare when the origin can handle it, without requiring manual configuration.

Why the guess was a problem

In TLS 1.3, the client must commit to a key agreement algorithm in the first packet. If the server prefers a different one, it sends a HelloRetryRequest, and the handshake takes an extra round trip. Cloudflare's static choice of X25519 was safe—over 95% of origins support it—but suboptimal for about 30% of connections. Some origins prefer P-256 or P-384, and many modern TLS stacks will immediately issue an HRR if they receive a classical X25519 keyshare while supporting post-quantum algorithms.

Post-quantum keyshares are much larger (1,216 bytes for X25519MLKEM768 vs. 32 bytes for X25519), which can push the ClientHello past a single network packet and cause issues with legacy middleboxes. That's why Cloudflare previously only advertised post-quantum support and relied on HRR to upgrade connections—a safe but slow approach.

Measuring instead of guessing

Automatic Key Exchange replaces the guess with a measurement. Cloudflare scans each origin to learn its exact key agreement capabilities, then tailors the initial keyshare on a per-origin basis. This maximizes post-quantum connections without risking outages, and it makes connections faster for domains that prefer non-X25519 algorithms.

The rollout is already having an impact: hundreds of thousands of domains now have post-quantum origin connections that nobody had to configure, and that number is growing daily. This is a step toward Cloudflare's goal of making the Internet quantum-secure by 2029, the year some experts predict classical encryption could be breached.

As Cloudflare notes, making post-quantum the default can't depend on millions of website operators becoming cryptographers. It has to be automatic—and now it is.