Cloudflare Maps a Post-Quantum Future for Web Privacy

Cloudflare is mapping a post-quantum future for web privacy with research on anonymous credentials. Its new estimates suggest the tokens could move from cryptography design toward protocol engineering. The company says its proposed MOLE framework uses multivariate cryptography and VOLE-in-the-Head proofs to support anonymous endorsements and credentials.

The estimates remain subject to change. Cloudflare says the post-quantum future for these protocols depends on security proofs and further study of multivariate schemes.

Building a post-quantum future for credentials

MOLE is designed to let people prove they hold an eligible credential without exposing which issuer provided it. Cloudflare describes VOLE-IHAT as a candidate for endorsements and VOLE-ACT as a candidate for credentials. Both use UOV, a multivariate signature scheme, with public keys of 46.6KB.

Cloudflare estimates VOLE-IHAT issuance at 5.6KB and presentation at 6.5KB for redemption. VOLE-ACT is estimated at 5.4KB for issuance and 12.0KB for a spend. Each operation takes a few milliseconds in its implementation, the company says.

Those sizes exceed classical alternatives, which Cloudflare says is expected in the post-quantum transition. Cloudflare compares replacing RSA blind signatures with PoMFRIT to replacing ECDSA with ML-DSA, with comparable overhead. Protocol engineering must address how one redemption can support multiple requests, since redemption on every request may be too costly.

How the privacy proof is assembled

In its MOLE research article, Cloudflare describes systems drawing on blind signatures, which let an issuer sign a commitment without seeing the underlying message. In the described process, a client hashes a message with randomness, sends the commitment for signing, then proves knowledge of the signature and opening. A verifier can check the proof with the issuer’s public key, while the issuer sees a different object from the verifier.

Cloudflare says proof size depends heavily on hashing. Its construction uses VOLEitH, a zero-knowledge proof technique built around correlated values and checks on a hidden computation. The source says VOLEitH can represent AES computations and equations over small binary fields. An example FAEST proof is about 4KB; KuMQuat signatures can be as small as 2.6KB.

For blind signatures, Cloudflare points to PoMFRIT, which was published by Baum and colleagues at USENIX Security 2026. The source says it reached 6.7KB for the blind signature and a few hundred bytes for issuance. Replacing MAYO with UOV can reduce the signature to 4.3KB, using the cited NIST round 3 UOV parameters and FAEST-EM-128s. Cloudflare says the larger public keys can be worthwhile when cached and used often.

The same building blocks could hide which anchor issued an endorsement. The prover includes the anchor index as hidden witness data while proving the signature relation. Cloudflare says related constructions could also support anonymous credit tokens and rate-limited credentials, with additional hashes and range checks.

Security work remains before adoption

Cloudflare cautions that cryptanalysis of multivariate cryptography is still developing. UOV and MAYO have weathered recent attacks, but the source says parameters may still need to grow, increasing costs. Some proof-size optimizations also rely on stronger assumptions, including a one-more-UOV assumption that needs more study.

The company is exploring smaller or fewer hash computations and alternative commitment designs. It says multivariate commitments could shrink proofs, but their security is not yet clear, including the risk to client privacy. Another proposed direction uses a low-degree pseudorandom generator, though suitable designs have not received much study.

Cloudflare says the immediate work is to produce proofs showing the protocols are secure if UOV is secure, while waiting for cryptanalysis to mature. It encourages cryptographers to study multivariate cryptography. Until those steps are complete, the estimates describe active research rather than a finished deployment.

For context on other Cloudflare infrastructure work, readers can review its cache rule changes and DNS cache redesign. Cloudflare has also described a system for checking verified bot behavior.

The research therefore points to a concrete next phase: validate the security assumptions and work out how the larger credentials fit real web protocols. That work will help determine how the post-quantum future for anonymous web credentials can advance.