Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)
Summary
Cloudflare's Automatic Key Exchange measures the capabilities of each origin to select the strongest key-exchange algorithm on the first try, prioritizing post-quantum hybrids when possible. This approach reduces HelloRetryRequests from about 52% to 3.7% and cuts p90 handshake latency by over 150 ms for the scanned origins. It also includes out-of-band origin scanning, per-origin weighting, and compliance options to balance security with compatibility, with a goal of quantum-secure origin connections by 2029.