--- url: "https://www.xcademia.com/news/cloudflare-explores-post-quantum-cryptography-for-the-future-of-web-privacy" title: "Cloudflare Explores Post-Quantum Cryptography for the Future of Web Privacy" description: "Cloudflare explores post-quantum anonymous credentials using VOLEitH, UOV and its MOLE framework to preserve web privacy." publishedAt: "2026-11-07T09:28:41.69+00:00" updatedAt: "2026-11-08T04:48:39.622778+00:00" type: news category: cybersecurity source_name: Cloudflare Blog source_url: "https://blog.cloudflare.com/vole-mole" tags: - "#PostQuantumCryptography" - "#Cryptography" - "#WebPrivacy" - "#AnonymousCredentials" - "#PrivacyPass" - "#Cloudflare" - "#ZeroKnowledgeProofs" - "#QuantumSecurity" --- # Cloudflare Explores Post-Quantum Cryptography for the Future of Web Privacy > Cloudflare explores how VOLE-in-the-Head and multivariate cryptography could support post-quantum anonymous credentials. Its MOLE research introduces two candidate schemes, VOLE-IHAT and VOLE-ACT, with promising size and runtime estimates. Source: **Cloudflare Blog** · 7 November 2026 **C**loudflare is exploring new cryptographic techniques to help protect online privacy as the industry prepares for the arrival of cryptographically relevant quantum computers. In new research published on November 6, 2026, the company explains how post-quantum anonymous credentials could support privacy-preserving authentication and abuse prevention without revealing users' identities. The research focuses on Cloudflare's MOLE framework, short for Moderation Of unLinkable Endorsements, and two candidate schemes called VOLE-IHAT and VOLE-ACT. These constructions combine VOLE-in-the-Head zero-knowledge proofs with multivariate cryptography to create post-quantum alternatives for anonymous endorsements and credentials. Cloudflare's approach builds on a recent blind-signature construction called PoMFRIT. By adapting its underlying cryptographic components, the company estimates that it can develop different types of anonymous credentials with relatively compact proofs and millisecond-scale operation times. However, the work remains under development. Cloudflare says the proposed protocols still require formal security proofs, and further cryptanalysis of the underlying multivariate cryptography is needed before their security assumptions can be relied upon. The research highlights a potential direction for maintaining privacy-preserving authentication as quantum computing changes the security assumptions behind existing cryptographic systems. ## Why Web Privacy Needs Post-Quantum Cryptography The transition to post-quantum cryptography is often discussed in the context of securing internet communications. Protocols such as Transport Layer Security (TLS) depend on cryptographic building blocks for authenticated key agreement. If sufficiently powerful quantum computers become available, quantum-vulnerable cryptographic algorithms could put these secure communication mechanisms at risk. However, Cloudflare points out that the challenge extends beyond TLS. The internet also relies on classical cryptography for privacy technologies, authentication, and systems designed to prevent abuse. One example is Privacy Pass, a protocol used by website operators to protect applications from abuse. Privacy Pass allows a client to obtain tokens that can later be redeemed to access a website or service. These tokens can support rate limiting without requiring users to identify themselves through accounts or persistent tracking mechanisms. The important property is unlinkability. A token's redemption cannot be linked to the client that originally obtained it. Cloudflare has used Privacy Pass in applications such as privacy proxies, including iCloud Private Relay, and relays such as Privacy Gateway. The company says it has approximately 10 years of deployment experience with Privacy Pass and is collaborating with other organisations to develop the next generation of privacy-preserving authentication technology. One objective is to provide more sophisticated ways to manage automated and agentic traffic that could otherwise consume resources and affect performance for human visitors. Another is to make the ecosystem more open by allowing more types of clients to participate. ## The Quantum Risk to Existing Privacy Pass Tokens Privacy Pass still relies on classical cryptography, including RSA and elliptic-curve cryptography. According to Cloudflare, a sufficiently capable quantum attacker could forge tokens and potentially bypass mechanisms that depend on them, such as rate limiting. However, the company distinguishes token security from user privacy. Privacy Pass provides unconditional privacy: even a quantum attacker cannot link a token's redemption to its issuance. Cloudflare says the new generation of private authentication technology can preserve this privacy guarantee after the arrival of cryptographically relevant quantum computers. This distinction provides some time to develop alternatives. Nevertheless, the company argues that post-quantum replacements are needed because existing cryptographic assumptions will not remain suitable for every application. One challenge is the size of post-quantum cryptographic constructions. Cloudflare compares ML-DSA-44 signatures, which are 2,420 bytes, with ECDSA-P256 signatures, which are only 64 bytes. The difference illustrates why simply replacing existing algorithms with post-quantum alternatives may not be practical without redesigning the protocols that use them. ## What Is MOLE and How Does It Extend Privacy Pass? Cloudflare's next-generation privacy framework is currently called MOLE, meaning Moderation Of unLinkable Endorsements. MOLE builds on the privacy properties of blind signatures while introducing a way to hide the identity of the entity that issued an endorsement. In a traditional blind-signature scheme, a client obtains a signature from an issuer without revealing the message being signed. The client can later present that message and signature to a verifier without allowing the issuer to link the presentation to the original issuance. Privacy Pass uses this approach to issue unlinkable tokens. However, a traditional Privacy Pass token still reveals the issuer's identity during verification because the verifier needs the issuer's public key. That information is useful in some situations. For example, a token issued by a particular organisation could indicate that a client is authorised to access that organisation's VPN product. But other applications only need to know that a token came from an entity within a trusted group. They do not need to know exactly which entity issued it. MOLE addresses this requirement through an object called an **endorsement**. ### How MOLE Endorsements Work An endorsement is issued by an anchor and later redeemed by a moderator. Before redemption, the client and moderator agree on an anchor set. This set contains the public keys of the anchors trusted by the moderator. During redemption, the client proves that an endorsement was issued by one of the trusted anchors without revealing which anchor issued it. If the endorsement is accepted, the moderator issues a MOLE credential that the client can use to moderate its interactions with the website. This approach hides the identity of the issuing anchor while still allowing the moderator to verify that the endorsement came from an accepted member of the trusted group. The distinction is important: - **Blind signatures** hide the message from the issuer during issuance. - **Unlinkability** prevents the issuer from connecting issuance with later presentation. - **MOLE endorsements** additionally hide which trusted anchor issued the endorsement. MOLE can support different types of credentials. These may include blind signatures, anonymous credit tokens, and anonymous rate-limited credentials. The framework is designed to support multiple credential systems rather than relying on a single cryptographic construction for every use case. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1794043024406-info-1--268-.webp) ## The Cryptographic Challenge: Building Flexible Post-Quantum Credentials Cloudflare identifies a major challenge in post-quantum anonymous credentials: separating cryptographic parameter selection from protocol design. In traditional credential systems, protocol designers can often use established cryptographic primitives without needing to understand every underlying mathematical parameter. Post-quantum constructions are more complicated. Many existing post-quantum algorithms come from larger mathematical frameworks that have been carefully adjusted for particular applications. Their security and performance depend on parameter choices that may not work equally well for other use cases. Cloudflare uses ML-DSA as an example. Its underlying framework can support different constructions, but the parameters used for ML-DSA have been selected to make that particular digital signature scheme efficient and secure. Those same parameters would not necessarily be suitable for building other cryptographic systems. This creates a problem for MOLE because the framework needs to support several types of credentials, endorsements, and privacy-preserving operations. The company therefore explores cryptographic building blocks that can be adapted to different protocols without requiring every new credential system to be designed from scratch. Two important ingredients in this research are VOLE-in-the-Head and multivariate signatures. ## VOLE-in-the-Head: A Foundation for Post-Quantum Zero-Knowledge Proofs VOLE-in-the-Head, commonly abbreviated as VOLEitH, is a zero-knowledge proof system introduced in research published at Crypto 2023. A zero-knowledge proof allows one party to demonstrate knowledge of a secret value that satisfies a public mathematical statement without revealing the secret itself. For example, a person could prove knowledge of an AES key that produces a known encryption result without disclosing the key. The proof can also be transformed into a digital signature. Cloudflare identifies FAEST as an example of a signature construction based on this approach and a candidate in NIST's signature standardisation effort. VOLE stands for Vector Oblivious Linear Evaluation. It is an interactive technique that allows two parties to obtain correlated random values. These correlations act like authentication tags. They allow a verifier to check whether a computation involving a hidden witness has been performed correctly. VOLEitH adapts this process to a non-interactive proof. Instead of having two parties generate the correlated values together, the prover prepares the values locally. The prover commits to them and applies the Fiat-Shamir transformation to determine which parts the verifier must check. This produces a non-interactive zero-knowledge proof. ## Why VOLEitH Is Useful VOLEitH is not a succinct proof system in the same way as some other modern proof systems. Its proof size grows linearly with the size of the witness and the arithmetic complexity of the statement being proved. However, Cloudflare highlights its efficiency for statements that can be expressed as equations over small binary fields. This makes it suitable for cryptographic operations involving AES and multivariate quadratic equations. For example, FAEST uses VOLEitH to prove knowledge of an AES key. Cloudflare cites FAEST proof sizes of approximately 4 KB under the relevant NIST Round 3 parameter set. Another example is KuMQuat, a signature scheme based on the Multivariate Quadratic problem. The MQ problem involves solving a system of random quadratic equations over a small field, such as GF(2⁸). Given the public equations and their output for a random input, an attacker must recover the original input. Cloudflare notes that the MQ problem is believed to remain difficult even for quantum computers. Because these equations are naturally suited to VOLEitH, proving knowledge of a solution can be relatively efficient. The article cites KuMQuat signatures as small as 2.6 KB. These examples illustrate why VOLEitH is relevant to post-quantum credential construction. It provides a proof system that can work efficiently with several types of mathematical statements. ## Multivariate Signatures: UOV and MAYO Another important component of Cloudflare's approach is multivariate cryptography. Multivariate signature schemes use systems of quadratic equations over small finite fields. Two constructions discussed in the research are Unbalanced Oil and Vinegar (UOV) and MAYO. Both are candidates in NIST's ongoing post-quantum digital signature standardisation effort. ### Understanding UOV UOV is a multivariate signature scheme in which the public key represents a quadratic map. A signature is a vector that satisfies the public equations for a target value derived from the message. The private key contains a trapdoor that allows the signer to solve the equations efficiently. This trapdoor works by dividing variables into two groups: - **Oil variables:** These variables are never multiplied by one another. - **Vinegar variables:** These variables can participate in the quadratic expressions. When the signer fixes the vinegar values, the remaining equations become a linear system that can be solved for the oil variables. The public key mixes the oil and vinegar variables, hiding the structure that makes signing efficient. Cloudflare cites a UOV signature size of 135 bytes, with a public key size of 46.6 KB. This represents a trade-off: relatively small signatures come with substantially larger public keys. MAYO offers another multivariate construction with smaller public keys, although its signatures are slightly larger. ### Why Multivariate Signatures Fit VOLEitH The key connection is that evaluating UOV or MAYO signatures has arithmetic complexity comparable to evaluating a general multivariate quadratic instance. Both involve public quadratic maps over small binary fields. That makes them suitable for VOLEitH, which can prove statements expressed through these types of equations. Combining the two approaches creates a path toward blind signatures and anonymous credentials that do not depend on the same lattice-based constructions used by many other post-quantum schemes. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1794043001793-info-2--250-.webp) ## PoMFRIT Shows How Blind Signatures Can Become More Compact The research builds on PoMFRIT, a blind-signature construction published by Baum and other researchers at USENIX Security 2026. At the time of publication, PoMFRIT achieved a record for candidate post-quantum constructions, with: - 6.7 KB for the blind signature. - A few hundred bytes for issuance. PoMFRIT combines VOLE-in-the-Head with the MAYO multivariate signature scheme. Cloudflare explains that replacing MAYO with UOV can reduce the blind signature size to approximately 4.3 KB. This estimate uses NIST Round 3 parameters for UOV, specifically uov-Ip, and FAEST-EM-128s parameters for VOLEitH. The trade-off is a larger public key. Cloudflare notes that this can be acceptable in applications where the public key can be cached and reused frequently. The company considers this approach competitive with state-of-the-art lattice-based constructions. More importantly, the building blocks used in PoMFRIT can be adapted to the different credential systems required by MOLE, including endorsements. ### How Blind Signature Issuance Works A blind signature allows a client to obtain a signature without revealing the message being signed to the issuer. The process begins with a commitment, which acts like a sealed envelope around the message. The client selects a message and generates random information to create a commitment. The issuer signs that commitment without learning the underlying message. The client then produces a zero-knowledge proof demonstrating knowledge of the signature and the randomness used to create the commitment. The resulting proof acts as the blind signature. A verifier can use the issuer's public key and the message to verify the proof. Because the issuer sees a commitment during issuance while the verifier sees a zero-knowledge proof during presentation, the two interactions cannot be linked, even if the issuer and verifier cooperate. ### Why Hash Functions Matter In this construction, the size of the zero-knowledge proof is heavily influenced by the hash operations that must be represented inside the proof. Cloudflare identifies the Keccak permutation used by SHAKE and TurboSHAKE as a suitable choice for VOLEitH. Its operations translate naturally into the proof system: - XOR becomes addition. - AND becomes multiplication. - Bit rotations become rearrangements of values. This is useful because VOLEitH works with small binary fields, making bit-oriented operations easier to represent than in proof systems designed primarily for large prime fields. However, Keccak evaluations still account for a large portion of the proof. Reducing the number and cost of hash operations is therefore important for improving credential efficiency. ## Adapting Blind Signatures for MOLE Endorsements and Credentials A conventional blind signature hides the message from the issuer, but MOLE needs an additional property: the endorsement must not reveal which trusted anchor issued it. To achieve this, the client must prove that an endorsement was issued by one of the public keys in an agreed anchor set without identifying the specific key. Cloudflare describes how the PoMFRIT construction can be adapted to support this requirement. The proof must demonstrate that a valid signature corresponds to one of the trusted anchor keys while keeping the anchor's identity hidden. The company says this can be represented using a set of constraints with roughly the same cost as the original construction: two hash operations and one multivariate quadratic evaluation. The proof also needs to establish additional information about the hidden witness. Cloudflare does not disclose the complete zero-knowledge circuit design in the article, describing this part as an example of the specialised work involved in cryptographic engineering. The same framework can support more advanced credential systems, including: - Anonymous credit tokens. - Anonymous rate-limited credentials. - MOLE endorsements. - Other credential constructions based on blind signatures. These systems may require additional hash operations and proofs that certain witness values fall within expected ranges. Cloudflare says range proofs add relatively little cost in VOLEitH. Across the constructions discussed, the number and size of Keccak evaluations remain major factors in the overall proof size. ## Optimisations That Could Reduce Proof Size Cloudflare discusses several optimisation techniques intended to make post-quantum anonymous credentials more practical. These changes can reduce proof sizes, but some introduce additional performance costs or security assumptions that require further analysis. ### 1. Using Fewer Hash Operations The PoMFRIT construction reduces the number of hash operations that need to be included in the zero-knowledge proof. A conventional blind-signature construction requires proving two hash evaluations: one associated with the client and another with the issuer. PoMFRIT divides VOLEitH proof generation into two stages. First, the client commits to a random mask, hashes the message outside the zero-knowledge circuit, combines the result with the mask, and sends the masked target to the issuer. The issuer uses the UOV trapdoor to find a preimage of that target. In the second stage, the client completes the proof that the preimage is consistent with the previously committed mask. The issuer, acting as the VOLEitH verifier, computes the hash directly instead of requiring the proof circuit to reproduce it. This reduces the size of the proof because fewer hash operations need to be represented inside the zero-knowledge circuit. However, the optimisation changes the security assumption. The ordinary UOV assumption states that an attacker cannot find a preimage for a random target without knowing the trapdoor. The optimised construction requires a stronger one-more-UOV assumption, which accounts for the additional information available to an attacker through the protocol. Cloudflare warns that this assumption may be overly optimistic and requires further study. The article refers to research in which attackers forged a 1024-bit RSA signature using a Privacy Pass issuer as a signing oracle. Privacy Pass uses 2048-bit RSA alongside other defence mechanisms. For UOV, Cloudflare suggests that NIST Level 3 parameters could be considered instead of Level 1. The company stresses that more research is needed before relying heavily on these optimisations. It also distinguishes the potential impact: a break in this assumption would affect an attacker's ability to forge tokens, not the ability to violate a client's privacy. ### 2. Making Each Hash Evaluation Cheaper Cloudflare also explores changes to Keccak to reduce the computational cost of hash operations inside the proof. Standard SHAKE uses a 1,600-bit Keccak state and 24 rounds of its underlying permutation. TurboSHAKE uses 12 rounds instead of 24. Cloudflare says this substantially reduces the size of VOLEitH proofs and considers the resulting security margin suitable for its application. Another optimisation involves reducing the Keccak state size. In the standard configuration discussed, 256 bits of the state are reserved for capacity to provide 128-bit security. The remaining 1,344 bits form the rate. Cloudflare proposes reducing the state to 800 bits, leaving a rate of 544 bits. The smaller state uses half as many multiplications in the proof circuit, reducing the proof size. The company also argues that, at the same number of rounds, the smaller state increases security because an attacker has less state to work with. ### 3. Using Multivariate Commitments Cloudflare explores whether conventional cryptographic hashes can be replaced with commitments that fit more naturally into multivariate cryptography. The proposed idea uses public random multivariate quadratic maps, represented as F and G, to construct a commitment: `c = (m + F(r), G(r))` Here, `m` represents the message and `r` represents randomness. The advantage is that the resulting constraints have the same degree as those used in the UOV signature construction. This could make proofs smaller and simpler by avoiding the need to evaluate conventional symmetric cryptography inside the zero-knowledge circuit. Cloudflare reports promising experimental results with this approach. However, the company says it is not yet clear whether the parameter settings that provide these improvements are also secure. Unlike some of the other optimisations, the concern here includes both signature unforgeability and client privacy. Cloudflare says substantially more research is needed. ### 4. Exploring Multivariate Pseudorandom Generators Another proposed direction is to use a pseudorandom generator (PRG) that works efficiently with multivariate cryptographic structures. With typical VOLEitH parameters, adding one additional witness bit can add approximately ten bits to the proof. Cloudflare describes a technique that could reduce this overhead to one proof bit per witness bit. The method begins by committing to a relatively short key. A low-degree PRG expands that key into a larger bitstream that can be computed efficiently inside the circuit. For each witness bit, the construction uses one additional PRG bit and stores the XOR of the witness bit and the generated bit in the proof. The trade-off is additional PRG computation and an increase in prover time because the witnesses begin at degree two rather than degree one. The proof-size advantage also becomes meaningful only when a sufficiently large number of witness bits are required. Cloudflare notes that an MQ-based PRG could be constructed, but this would be slow and potentially overly conservative. The Goldreich PRG represents another extreme, but the company says it would prefer an approach between these options. Such intermediate PRGs have not yet received much research attention. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1794042978320-info-3--228-.webp) ## Are Post-Quantum Anonymous Credentials Ready for the Web? Cloudflare's research provides cost estimates for two candidate constructions currently being developed within the MOLE framework. They use UOV with the uov-Ip parameter set, resulting in public keys of 46.6 KB. VOLEitH uses the same parameters as FAEST-EM-128s. The two constructions are: - **VOLE-IHAT:** A candidate scheme for MOLE endorsements. - **VOLE-ACT:** A candidate scheme for MOLE credentials. Cloudflare also compares them with PoMFRIT using UOV. ## Estimated Issuance and Presentation Sizes Construction Issuance Presentation PoMFRIT with UOV Below 1 KB 4.3 KB redemption VOLE-IHAT 5.6 KB 6.5 KB redemption VOLE-ACT 5.4 KB 12.0 KB spend These are current estimates, not final standardised performance figures. Cloudflare explicitly says the numbers may change as the constructions are analysed and developed. The company notes that the sizes are considerably larger than their classical counterparts. However, it considers the overhead comparable to the transition from RSA blind signatures to PoMFRIT and from ECDSA to ML-DSA. Cloudflare also reports that each operation takes only a few milliseconds in its implementation. Runtime could be improved further, although the company notes that doing so would increase communication costs. ## Why Protocol Engineering Still Matters If the current estimates hold, Cloudflare believes post-quantum anonymous credentials could move from a primarily cryptographic design challenge toward protocol engineering. However, the larger proof and signature sizes introduce practical considerations. For example, classical blind signatures may be inexpensive enough to redeem on every request. With post-quantum alternatives, Cloudflare says it will need to explore how a single redemption can be amortised across multiple requests. This means the transition involves more than selecting a secure cryptographic algorithm. Systems using these credentials may need changes to how they issue, present, verify, and reuse credentials. ## What Still Needs to Be Proven? Cloudflare identifies two major requirements before relying on the proposed constructions. **Formal security proofs** The protocols need formal proofs demonstrating that their security holds as long as UOV remains secure. **Further cryptanalysis** The company wants the cryptographic community to study multivariate cryptography more extensively. Recent advances have affected several parameter regimes, and the security of the selected UOV parameters needs continued examination. Cloudflare says UOV and MAYO have withstood recent attacks, but it does not treat this as a reason to skip further analysis. The company encourages cryptographers to investigate multivariate cryptography and help establish stable parameters. The current constructions are promising research candidates, but the article does not announce a completed standard or a general production deployment. ## What Cloudflare's Research Means for the Future of Web Privacy Cloudflare's work highlights an important aspect of the post-quantum transition: protecting privacy technologies requires more than replacing vulnerable digital signatures. Systems such as Privacy Pass and MOLE depend on several cryptographic properties working together. They must allow users to prove eligibility, obtain credentials, and access services without revealing unnecessary identity information. The proposed combination of VOLEitH and multivariate cryptography offers a possible way to preserve these properties while preparing for quantum-capable attackers. For the wider industry, this research also demonstrates why cryptographic flexibility matters. A reusable set of building blocks could support different anonymous credential systems without requiring each protocol to depend on a completely separate construction. However, the estimated sizes, security assumptions, and performance trade-offs still require further evaluation. Cloudflare's research suggests that post-quantum anonymous credentials are moving toward a stage where protocol engineering may become a more practical focus. Formal security proofs and continued cryptanalysis remain essential before these approaches can be relied upon. The work is an important research step toward maintaining unlinkable, privacy-preserving authentication in a post-quantum internet. ## Original source https://blog.cloudflare.com/vole-mole ## Tags `#PostQuantumCryptography` · `#Cryptography` · `#WebPrivacy` · `#AnonymousCredentials` · `#PrivacyPass` · `#Cloudflare` · `#ZeroKnowledgeProofs` · `#QuantumSecurity` --- ## About this content This Markdown news article is the citation-grade twin of [Cloudflare Explores Post-Quantum Cryptography for the Future of Web Privacy](https://www.xcademia.com/news/cloudflare-explores-post-quantum-cryptography-for-the-future-of-web-privacy). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/cloudflare-explores-post-quantum-cryptography-for-the-future-of-web-privacy - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt