Securing today for the quantum future: WARP client now supports post-quantum cryptography (PQC)

Cloudflare has announced that its WARP client now supports post-quantum key agreement, extending PQC protection to both its free consumer 1.1.1[.]1 service and the enterprise Cloudflare One Agent. According to the National Institute of Standards and Technology (NIST), the Internet is transitioning to PQC in preparation for Q-Day, and Cloudflare notes that over 45% of human-generated Internet traffic to its network is already post-quantum encrypted.

The rollout in the WARP client introduces a phased approach, with Phase 1 providing automated PQC downgrades to classical cryptography if PQC negotiation fails, and Phase 2 planned to switch to PQC-only to defend against downgrade attacks by mid-2026. An optional Mobile Device Management override allows organisations to activate PQC immediately, ensuring the client negotiates PQC and fails closed if it cannot.

The update also highlights a hybrid TLS setup using ML-KEM alongside classical schemes and explains how MASQUE tunnels protect traffic end-to-end, with PQC tunnels extending from the user to Cloudflare’s network and onward to the origin server where applicable.