---
url: "https://www.xcademia.com/news/cloudflare-workers-adds-ml-kem-and-ml-dsa-support-for-post-quantum-cryptography"
title: "Cloudflare Workers Adds ML-KEM and ML-DSA Support for Post-Quantum Cryptography"
description: "Cloudflare Workers now supports ML-KEM and ML-DSA through Web Crypto, helping developers experiment with post-quantum cryptography natively."
publishedAt: "2026-10-02T09:27:46.244+00:00"
updatedAt: "2026-10-11T21:39:52.952658+00:00"
type: news
category: "cloud-security"
source_name: Cloudflare Blog
source_url: "https://blog.cloudflare.com/workers-ml-kem-ml-dsa-support/"
tags:
  - "#PostQuantumCryptography"
  - "#CloudflareWorkers"
  - "#MLKEM"
  - "#MLDSA"
  - "#WebCrypto"
  - "#Cybersecurity"
  - "#Cryptography"
  - "#QuantumSecurity"
---

# Cloudflare Workers Adds ML-KEM and ML-DSA Support for Post-Quantum Cryptography

> Cloudflare Workers now supports ML-KEM and ML-DSA through Web Crypto, giving developers native building blocks to test and integrate post-quantum cryptography without bundling separate implementations.

Source: **Cloudflare Blog** · 2 October 2026

Cloudflare has added opt-in support for modern post-quantum cryptographic algorithms to **Cloudflare Workers**, bringing ML-KEM and ML-DSA directly into its Web Crypto implementation.

Announced on October 1, 2026, the update gives Workers developers access to post-quantum cryptographic primitives through JavaScript APIs rather than requiring them to bundle separate cryptographic implementations in JavaScript or WebAssembly.

The initial implementation is available behind the `webcrypto_modern_algorithms` compatibility flag while the underlying Web Cryptography API proposal continues to evolve. Cloudflare describes the release as a set of building blocks for experimentation and integration rather than a complete post-quantum migration solution.

## 
What Cloudflare is adding

The Workers implementation supports two major categories of post-quantum cryptography:

- **ML-KEM-768 and ML-KEM-1024** for key encapsulation
- **ML-DSA-44, ML-DSA-65 and ML-DSA-87** for digital signatures
- `encapsulateBits()` and `decapsulateBits()`
- `encapsulateKey()` and `decapsulateKey()`
- `getPublicKey()`
- `SubtleCrypto.supports()`
- JWK import and export for the supported algorithms

Cloudflare says the initial implementation specifically starts with ML-KEM-768 and ML-DSA-44, while the additional variants are also supported. ML-KEM-512 is not supported because the version of BoringSSL used by Workers does not expose that variant.

## 
Why post-quantum cryptography matters

Modern public-key cryptography relies heavily on algorithms such as RSA and elliptic-curve cryptography. Large-scale quantum computers could eventually threaten some of these cryptographic systems.

Post-quantum cryptography, or PQC, aims to provide cryptographic algorithms designed to resist attacks from quantum computers.

NIST finalised its first major post-quantum standards in August 2024, including **ML-KEM for key establishment** and **ML-DSA for digital signatures**.

The migration is not simply a matter of replacing one algorithm with another. Applications, protocols, libraries and infrastructure all need to support the new primitives.

Cloudflare's Workers update addresses one part of that transition by making the underlying cryptographic operations available through the runtime.

![https://images.openai.com/static-rsc-4/C9yTZFpDMI9aDzG6rMGfZ7xjfQhXlQdCKJp2sk-ruYn-i3GEFvmAab6ZGnfSBUfNUy_Yskj62o4VZXvgDMC0ZPksKXfxrILGUmfgIMAKaRC_belquoweiRzDcz2Scoplk2S046KLiWlCuRiuWok1lc1p9vAIPvvFQx8Hu4C7Ovaz9OxKfOSxb8Vuns2GJtUO?purpose=fullsize](https://images.openai.com/static-rsc-4/4qZvEn0OxC5_W4d27eF_Sa6ByFENTPS8d0Z6T0cViecNydNtYrTwoijnkgGEu6I-C9W3YkcS3u_GLT3lgACHcV3OQkasCQLtOWKmtV6xJpy8zzw_qS4SIa2_dG_jfLLZKAH8O_je1HZKbN5DSgfgO44xcZjCqGFXTP0UZ2Ay1QA?purpose=inline)![https://images.openai.com/static-rsc-4/wmvBJYYW0oGqiVhLuYXrRnzm80tgEhaWtsgZh0JMwnlYhmozYrzeqyn05uASfT0vV4Fq_m6-VSlz383UZR2qGRp60WiEiDDZJNjAAyX0xS1FPfHCqkRZywXwRxK-gRGS73jMGpWgJT6vEeXUqpQBTpRllnQgYKBmC6w3_09UAmxP2bLKd1sUbBGdhFV9FqWN?purpose=fullsize](https://images.openai.com/static-rsc-4/Wt6fnA3fmwjLffu-3wo2M02nNIP27sQW3cjmRei1aZzcXAMWj-04BtVcLtEXm2RmTMYuvdzeMf5ReZUcj4TZmEprykiVDIBCkC5Ihp8Bqde75vR2-1Ip6me9c2XjsjFSjVLbwBypqcd3iS1bkahsiFemo64IREegX2iYiz5wMvY?purpose=inline)

## 
ML-KEM and ML-DSA have different roles

ML-KEM and ML-DSA are designed for different cryptographic tasks.

**ML-KEM** is a key encapsulation mechanism. It allows one party to encapsulate shared secret material using a recipient's public key. The recipient uses the corresponding private key to recover the same shared secret.

Cloudflare's example uses:

```

```

```
const keys = await crypto.subtle.generateKey("ML-KEM-768", true, [
  "encapsulateBits",
  "decapsulateBits",
]);

const { sharedKey, ciphertext } =
  await crypto.subtle.encapsulateBits(
    "ML-KEM-768",
    keys.publicKey,
  );

const sameSharedKey =
  await crypto.subtle.decapsulateBits(
    "ML-KEM-768",
    keys.privateKey,
    ciphertext,
  );
```

ML-KEM itself does not provide complete application-level encryption. Cloudflare explains that constructions such as **Hybrid Public Key Encryption (HPKE)** can use the shared key material together with a key schedule and an authenticated encryption algorithm such as AES-GCM.

**ML-DSA**, meanwhile, is a digital signature algorithm. Its usage is conceptually closer to familiar signing systems such as Ed25519 or ECDSA.

A developer can generate a key pair, sign data and subsequently verify the signature.

```

```

```
const data = new TextEncoder().encode("hello post-quantum");

const { publicKey, privateKey } =
  await crypto.subtle.generateKey(
    "ML-DSA-44",
    false,
    ["sign", "verify"],
  );

const signature =
  await crypto.subtle.sign(
    "ML-DSA-44",
    privateKey,
    data,
  );

const valid =
  await crypto.subtle.verify(
    "ML-DSA-44",
    publicKey,
    signature,
    data,
  );
```

Cloudflare stresses that these APIs are cryptographic primitives rather than complete protocols.

## 
Native Web Crypto reduces the need for bundled implementations

Before runtime support was available, developers wanting to experiment with post-quantum cryptography in JavaScript environments generally had to rely on separate JavaScript or WebAssembly implementations.

That approach can increase application dependencies and leaves individual developers and libraries responsible for selecting and maintaining cryptographic implementations.

By exposing the primitives through Web Crypto, Workers can instead provide a runtime-level implementation that libraries can use when supported.

This is particularly relevant for libraries intended to operate across multiple Web-compatible runtimes.

![https://images.openai.com/static-rsc-4/mNrasU1lcDYaJImy56gXa6wLJZpy_S82ev90OOydXectpSx7UQL15sCaGWeaqjpUt9R-YvnwnA_3xnHUJocIfR-hQCasLs166y1cIYL_R7zGqaZNGLmXfJ-vmztRUx4NNPm8T7G9CCDegKHmoQv5CKR9AVTHFrm5jtyJrDBkpmZoBrDYETre4b2X3R39TEia?purpose=fullsize](https://images.openai.com/static-rsc-4/joIqaaxQ1p7jTvJ5eO_yChCjoarxbnyIvCpEzm3kBbIKdsCHTQGfjjYjg5RSC4R5GE_s7HFON6EXzn7Pf9ex3uYd-ITa-kE3da5KbacQmCmy9uc6blQS5AKhYSZcqwuUb6SpvGuiy9OuN87gxbVQ0sI-nroHawNPCz4_dMhCAG4?purpose=inline)![https://images.openai.com/static-rsc-4/QwdU6nRo1knFU1hxz3_B0Z7aqjIo8jEurH1OsnCeS3zebvKzIeI73KVWQweM23UFLRNpsUiX2RWF24csqP0mrGVeATT4P61Upd9OEKuF3zMJxh95XhWvL8yt0Xng_iuoW0xgH7eJks1E5HE6z8bCSrG7BpuK5f-XSeHdopw6GFujhkQEYDtS0HK5nziVHFsH?purpose=fullsize](https://images.openai.com/static-rsc-4/I8rwqIvHk6nhvfVKFbWqErdIo2sFjJ_RNThbz7JIpVaArJ-m83w5xPsJ9f8EnxYYLjmSZxvqATZDQ4cPeAq_WckPccvvyemfa94G5Z1YB1PU0kEOmf071UYFXAtEL-mei02XuB9haXaCW4xAvlP5BUiI4aBpTVEXGg_Kbjo4tEA?purpose=inline)

## 
ML-DSA can be used for signed JWTs

Cloudflare highlights signed JSON Web Tokens as one example of how ML-DSA could be incorporated into higher-level applications.

Using the `jose` library, an application can generate an ML-DSA key pair, create a signed JWT and verify it.

The important architectural change is that the library can delegate the underlying ML-DSA operation to the runtime rather than carrying its own cryptographic implementation for every supported environment.

This illustrates a broader pattern: applications can continue working with familiar higher-level protocols while runtime cryptography handles the underlying primitive.

## 
ML-KEM can support HPKE and OHTTP integrations

Cloudflare also points to **HPKE** as an important use case for ML-KEM.

ML-KEM supplies the key encapsulation component, while HPKE combines key establishment with a key schedule and authenticated encryption.

Cloudflare notes that libraries such as `panva/hpke` are structured around Web Crypto and can use ML-KEM when the runtime exposes the necessary primitive.

This could also support future post-quantum migration work involving protocols such as **Oblivious HTTP (OHTTP)**, which uses HPKE.

However, runtime support alone does not automatically make an application or protocol post-quantum secure. Protocol implementations still need to select and correctly integrate appropriate cryptographic suites.

## 
New helper APIs simplify key handling

The update also introduces `getPublicKey()`.

The API can be useful in systems where an application has loaded a private key but needs to obtain the corresponding public key.

For example:

```

```

```
const publicKey =
  await crypto.subtle.getPublicKey(
    privateKey,
    ["verify"],
  );
```

For ML-KEM, the relevant operation uses the encapsulation capability:

```

```

```
const publicKey =
  await crypto.subtle.getPublicKey(
    privateKey,
    ["encapsulateBits"],
  );
```

Cloudflare says this is intended to reduce format-specific or duplicated key-handling code in cryptographic libraries.

## 
Developers should check runtime support

The modern cryptographic API is not yet universally available across runtimes.

Cloudflare therefore recommends feature detection using `SubtleCrypto.supports()` rather than assuming that every runtime implements a particular algorithm.

For example:

```

```

```
if (SubtleCrypto.supports("sign", "ML-DSA-44")) {
  const keys = await crypto.subtle.generateKey(
    "ML-DSA-44",
    false,
    ["sign", "verify"],
  );
}
```

This approach is particularly relevant for libraries that need to work across Workers, Node.js, Deno, browsers and other Web-interoperable environments.

## Workers support is currently opt-in

Developers need to enable the `webcrypto_modern_algorithms` compatibility flag.

```

```

```
{
  "compatibility_flags": [
    "webcrypto_modern_algorithms"
  ]
}
```

Cloudflare says the algorithms remain behind the flag because the API is based on a draft specification and the company wants feedback from library authors before treating the implementation as stable.

## 
Built on workerd and BoringSSL

Cloudflare Workers runs on **workerd**, Cloudflare's open-source runtime built on V8.

The new implementation adds ML-KEM and ML-DSA to workerd's Web Crypto layer and uses cryptographic primitives backed by BoringSSL.

Cloudflare also says the release includes Web Platform Tests, Workers-specific compatibility-flag tests and TypeScript definitions for the new API surface.

The initial implementation deliberately has a limited scope. Other algorithms and APIs from the broader modern Web Crypto proposal, including SHA-3, cSHAKE, TurboSHAKE, ChaCha20-Poly1305 and HPKE, are not part of this initial change.

![https://images.openai.com/static-rsc-4/j_NKF8MNo2DlIe3dQ036EEGmH3JxJLwnWbxuROfxlfIX8cw0izyLw4VUZC74LkUGQ75mT5DCwyHMxdOIhcFmztCRePRwDrP-Qhz8g6KJlzNMXb4efnK9FyUA6SoXlPs-rHYmjK8X78U0AksrSjR2HH-eXVKvv2TQhcltVwWqhFWyWhMK81b86TsAZuTv82k2?purpose=fullsize](https://images.openai.com/static-rsc-4/CT_lXyTi5PqJjCtoVSJm3b3ed8_IbANPnmRROA4GFmkoA0E2dZt6P0UWOSwQ5LJNexQay5wvUKZ6kJ5VU0h9MissCmNgA6B2ffmxXCPgKgeDpPRxeqJtCKWyG-nQobE6eSMNWByDxf9s_dgvK3tyhKpWZrclKSHAk69kUmEuQeA?purpose=inline)

## 
Larger keys and signatures remain a consideration

Native runtime support can reduce the need to bundle separate implementations, but it does not remove the practical characteristics of post-quantum algorithms.

Cloudflare specifically notes that ML-DSA public keys and signatures are substantially larger than those used by RSA or Ed25519.

That means developers still need to consider the size of cryptographic material when designing systems that store or transmit keys, signatures and related data.

This is an important distinction. Improving runtime access to post-quantum primitives addresses implementation and integration challenges, but it does not eliminate the engineering trade-offs associated with post-quantum cryptography.

## 
What comes next for Workers' modern cryptography

Cloudflare says additional work remains around the broader modern Web Crypto proposal.

The company identifies SHA-3, ChaCha20-Poly1305, cSHAKE, TurboSHAKE and HPKE among the areas not included in this initial implementation.

Another open question is when these algorithms should move from opt-in functionality to default support. Cloudflare says the current compatibility flag provides a way to gather feedback while the specification continues to develop.

## 
What this means for developers

The announcement highlights a broader industry shift toward making post-quantum cryptography available closer to the application runtime.

For developers, the immediate value is the ability to experiment with ML-KEM and ML-DSA through Web Crypto without necessarily bundling a separate implementation.

For library maintainers, native support also creates an opportunity to design implementations that detect available cryptographic capabilities and delegate operations to the runtime where appropriate.

For enterprises, this could make early testing of post-quantum integrations easier across applications running on Workers. However, the update should not be interpreted as a complete migration solution. Cloudflare explicitly describes the APIs as building blocks rather than a full migration path.

Cloudflare's broader post-quantum work also shows that the company is addressing the transition at multiple layers. Its recent work includes visibility into post-quantum TLS traffic and continued development around post-quantum key exchange and authentication.

## 
Conclusion

Cloudflare Workers' new ML-KEM and ML-DSA support gives developers access to important post-quantum cryptographic primitives through Web Crypto.

The release covers key encapsulation, digital signatures, public-key extraction, capability detection and JWK support, while keeping the functionality opt-in through the `webcrypto_modern_algorithms` compatibility flag.

The broader significance is less about a single API addition and more about making post-quantum cryptography easier to integrate into existing Web-based software. As standards and implementations continue to mature, runtime-level support can give developers a practical environment in which to test protocols and prepare applications for the post-quantum transition.

## Original source

https://blog.cloudflare.com/workers-ml-kem-ml-dsa-support/

## Tags

`#PostQuantumCryptography` · `#CloudflareWorkers` · `#MLKEM` · `#MLDSA` · `#WebCrypto` · `#Cybersecurity` · `#Cryptography` · `#QuantumSecurity`

---

## About this content

This Markdown news article is the citation-grade twin of [Cloudflare Workers Adds ML-KEM and ML-DSA Support for Post-Quantum Cryptography](https://www.xcademia.com/news/cloudflare-workers-adds-ml-kem-and-ml-dsa-support-for-post-quantum-cryptography). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite.

When citing or quoting, please attribute *Xcademia* and link back to the source URL above.

- Source: https://www.xcademia.com/news/cloudflare-workers-adds-ml-kem-and-ml-dsa-support-for-post-quantum-cryptography
- Publisher: Xcademia, https://www.xcademia.com
- Catalogue index: https://www.xcademia.com/llms-full.txt