The introduction of ML-KEM-768 adds approximately one point one kilobytes of data from server to client, slightly increasing the bandwidth requirements for every secure handshake. This specific technical shift represents the first tangible cost of moving toward a quantum-resistant internet, a transition that has moved from theoretical research into the core infrastructure of the world’s largest cloud providers. As organizations evaluate their security posture in 2026, the divergence between Cloudflare’s network-wide automation and Amazon Web Services’ service-specific deployment model has become the central point of comparison for systems architects. The primary challenge is no longer whether to adopt post-quantum cryptography, but rather how to implement it without compromising the performance gains achieved through the broad adoption of TLS 1.3 over the past few years. Both companies have standardized their offerings around the National Institute of Standards and Technology’s finalized algorithms, yet the operational experience of managing these protocols varies significantly depending on whether the traffic is passing through a content delivery network or terminating directly at a managed cloud service.
1. Why Post-Quantum Encryption Became Urgent in 2026
The fundamental driver for this massive infrastructure overhaul is the persistent threat of “harvest now, decrypt later” attacks, where adversaries capture encrypted traffic today with the intent of breaking it once cryptographically relevant quantum computers become available. This strategy is particularly dangerous for data with long-term sensitivity, such as classified government communications, proprietary trade secrets, or healthcare records that must remain confidential for decades. In 2026, the security industry recognizes that the window for protecting such information is closing, as the progress in quantum hardware continues to accelerate. By implementing hybrid key exchange mechanisms now, providers ensure that even if the classical elliptic-curve math is eventually bypassed, the second layer of lattice-based cryptography remains intact. This dual-layer approach provides a safety net that protects current data streams against future decryption technologies without requiring a complete abandonment of the battle-tested classical algorithms that the internet has relied upon for years.
Beyond the theoretical threats, the regulatory landscape has solidified into a mandate for change, with agencies such as the National Security Agency enforcing the Commercial National Security Algorithm Suite 2.0. These requirements have forced cloud vendors and their enterprise clients to adhere to strict migration timelines that start in 2026 and extend through the end of the decade. Financial regulators and international standards bodies have followed suit, creating a environment where post-quantum readiness is no longer a luxury but a prerequisite for many high-value contracts. This compliance-driven momentum has accelerated the deployment of ML-KEM across the board, as companies realize that failing to support these protocols could result in losing access to government and highly regulated private-sector markets. The transition has consequently moved from a niche cybersecurity concern to a top-tier business continuity priority for global enterprises that cannot afford even a hypothetical risk to their encrypted data pipelines.
2. The NIST Standards Both Companies Are Building On
The foundation for this entire shift is the set of standards finalized by the National Institute of Standards and Technology, specifically FIPS 203, FIPS 204, and FIPS 205. FIPS 203 defines the Module-Lattice-Based Key-Encapsulation Mechanism, or ML-KEM, which is the primary tool used by both Cloudflare and AWS to secure the key exchange process during a TLS handshake. This algorithm was selected after a multi-year competition that winnowed down dozens of candidates to the most mathematically robust and computationally efficient options. By standardizing on ML-KEM, the industry has avoided the fragmentation that often plagues early-stage cryptographic transitions, ensuring that clients and servers from different vendors can interoperate seamlessly. Both Cloudflare and AWS have integrated these finalized standards into their proprietary cryptographic libraries, moving away from the experimental “Kyber” drafts that were used during the early testing phases between 2024 and 2025.
While ML-KEM handles the establishment of secure connections, the transition for digital signatures via ML-DSA and SLH-DSA is progressing on a slightly different trajectory. These standards, defined in FIPS 204 and FIPS 205 respectively, are intended to replace the RSA and ECDSA signatures currently used to verify the identity of servers through digital certificates. However, because updating the global certificate authority infrastructure is a much more complex task than updating key exchange protocols, this part of the migration is moving more slowly. Cloudflare and AWS have both focused their initial efforts on the key exchange because it addresses the immediate threat of data harvesting. The signatures, which protect against active impersonation rather than passive recording, are being integrated into internal service-to-service communication first, with public-facing post-quantum certificates expected to become more common as browser support for these new formats continues to mature throughout 2026.
3. Cloudflare’s Six-Year Path to General Availability
Cloudflare’s journey toward post-quantum security began long before the standards were finalized, starting with experimental deployments and research papers as early as 2017. The company has maintained a remarkably transparent public record of this process, documenting every step from the first tests of the HRSS and SIKE algorithms to the final adoption of ML-KEM. This long-term commitment allowed Cloudflare to identify potential performance bottlenecks and compatibility issues in a controlled environment before rolling out the technology to its entire global network. By the time general availability was announced, Cloudflare had already processed billions of connections using hybrid post-quantum groups, giving its engineering team a unique dataset on how these protocols behave across a vast and diverse set of client devices and network conditions. This experience was instrumental in refining the “default-on” approach that characterizes the company’s current service model, where the upgrade is handled automatically for the customer.
By 2026, Cloudflare has reached a significant milestone where approximately 70% of all browser-generated traffic hitting its edge is negotiating connections using post-quantum key exchange. This high adoption rate is a direct result of the company’s decision to terminate TLS at its own edge, allowing it to act as a bridge between modern browsers and origin servers that may not yet support the latest cryptographic standards. The rollout has been structured as an infrastructure-wide upgrade rather than a feature that customers must manually enable, which has drastically accelerated the migration compared to traditional opt-in models. This strategy has not only protected Cloudflare’s clients but has also acted as a catalyst for the rest of the industry, as the company’s massive traffic volume provides the necessary incentive for browser developers and library maintainers to prioritize post-quantum compatibility. The company’s stated goal is to achieve 100% post-quantum coverage across all its services by the end of the current three-year planning cycle.
4. How Cloudflare’s Hybrid ML-KEM Actually Works
The technical implementation at Cloudflare relies on a hybrid key exchange group known as X25519MLKEM768, which combines the industry-standard X25519 elliptic-curve Diffie-Hellman exchange with the newer ML-KEM-768 lattice-based mechanism. This hybrid approach ensures that the connection is at least as secure as a traditional TLS 1.3 connection while adding a layer of quantum resistance. If a weakness is ever discovered in the new lattice-based math, the security of the connection still rests on the well-understood elliptic-curve foundations. This design is specifically intended to mitigate the risks associated with deploying new cryptography at scale. Cloudflare’s stack is optimized to handle the additional 1.1 kilobytes of data sent during the server’s portion of the handshake, ensuring that the increase in packet size does not lead to fragmentation or dropped connections on the majority of modern networks, which have already been adjusted for the larger payloads.
One of the most critical components of Cloudflare’s implementation is the “Automatic Key Exchange” feature, which was refined throughout late 2025 to solve the problem of handshake retries. In earlier experimental versions, many connections required a “HelloRetryRequest” because the client and server could not agree on a key group in the first attempt, adding a full network round trip to the latency. Cloudflare’s current logic identifies when an origin server is capable of post-quantum negotiation and prioritizes that path, reducing the retry rate from over 50% to less than 4%. This optimization has proven vital for maintaining the performance expectations of modern web applications, as it allows 99.2% of post-quantum handshakes to complete in a single round trip. This focus on the “visitor-to-origin” leg of the connection ensures that the entire path is protected, not just the segment between the user and the CDN edge, effectively creating an end-to-end quantum-resistant tunnel for sensitive data.
5. AWS Takes a Service-by-Service Approach
Amazon Web Services has adopted a more targeted deployment strategy, focusing on specific high-security services rather than a blanket network-wide rollout. Starting in early 2025, AWS enabled hybrid ML-KEM support for Key Management Service, Certificate Manager, and Secrets Manager. This approach reflects the different needs of AWS’s diverse customer base, many of whom require fine-grained control over their cryptographic configurations for compliance and performance reasons. By integrating post-quantum support into the identity and secrets layer first, AWS addressed the most critical vulnerabilities for enterprise customers who use these services to manage the foundational keys of their entire cloud architecture. This service-by-service migration allows AWS to provide deep integration and FIPS-validated options for each component, ensuring that the most sensitive parts of a customer’s infrastructure are the first to be hardened against future quantum threats.
Unlike the default-on model, AWS requires customers to take active steps to utilize these new capabilities, such as updating to the latest versions of the AWS SDK, Lambda extensions, or CSI drivers. This puts the responsibility for migration timing in the hands of the customer, which is often preferred by large organizations with complex change-management processes. For example, AWS Secrets Manager users must explicitly upgrade their workload credentials providers to version 2.0.0 or later to enable the hybrid key exchange. While this model leads to a slower overall adoption rate compared to Cloudflare, it ensures that every migration is a deliberate choice supported by the customer’s own testing and validation procedures. To support this, AWS provides extensive documentation and specific security policies, such as the TransferSecurityPolicy-2025-03 for its Transfer Family service, which allow engineers to precisely define when and where post-quantum cryptography is utilized across their global AWS footprint.
6. Cloudflare vs AWS: Post-Quantum Encryption Specs Compared
When examining the technical specifications, both providers utilize ML-KEM-768 as their primary post-quantum key-encapsulation mechanism, adhering to the FIPS 203 standard. The difference lies in the implementation details and the surrounding ecosystem of cryptographic libraries. AWS builds its support on AWS-LC, an open-source library that has achieved FIPS 140-3 validation, a critical requirement for many government and defense contractors. Cloudflare, meanwhile, utilizes its own highly optimized edge stack which is designed for high-concurrency and low-latency processing of public web traffic. Both providers have successfully migrated away from the draft “Kyber” implementation, ensuring that their current production systems are fully compliant with the final NIST standards. This alignment on the underlying math means that a client capable of negotiating post-quantum TLS can do so with either provider using the same standard hybrid groups, maintaining interoperability across the multi-cloud landscape of 2026.
The protocol scope also varies between the two companies, with Cloudflare focusing exclusively on TLS 1.3 and HTTP/3 for its post-quantum rollout. This decision simplifies the deployment by excluding older, less secure protocols that are more difficult to retrofit with modern cryptography. AWS, by contrast, has implemented post-quantum support in a way that is more dependent on the individual service, sometimes allowing it within specific TLS 1.2 configurations for legacy enterprise environments that cannot yet move to 1.3. Furthermore, Cloudflare’s coverage extends into its SASE and Zero Trust platforms, providing post-quantum protection for corporate WAN traffic and IPsec tunnels, whereas AWS has prioritized managed services like Transfer Family and Load Balancers. These differing priorities mean that Cloudflare is often the better fit for organizations looking to secure a wide range of public-facing web traffic and remote employee connections, while AWS offers a more specialized toolset for securing internal application infrastructure and managed file transfers.
7. Benchmark DatHandshake Overhead and Latency, Three Sources Compared
Performance benchmarks in 2026 indicate that the cryptographic cost of ML-KEM is relatively minor, typically adding only about 4% to the overall handshake duration when properly configured. This overhead is largely consistent across different providers, as it is a function of the mathematical operations required by the lattice-based algorithms. However, the real-world impact on user experience is much more dependent on network overhead than on CPU cycles. Because the hybrid handshake adds approximately 2.3 kilobytes of total data across both directions, it can lead to packet fragmentation on networks with a small Maximum Transmission Unit or high packet loss. Independent academic studies have confirmed that while the computational latency is negligible on modern server hardware, the increased bandwidth requirement is a measurable factor that can affect performance on lower-quality mobile or satellite links, where every additional packet matters.
A critical finding from mid-2025 and 2026 performance audits is that the biggest source of latency is not the encryption itself but the frequency of “HelloRetryRequest” events. Cloudflare’s refinement of its Automatic Key Exchange reduced these events significantly, which resulted in a 150-millisecond improvement at the 90th percentile of handshake latency. Without such optimizations, a post-quantum connection can feel substantially slower to the end user, not because the math is slow, but because the network has to do more work to negotiate the connection. AWS has addressed this by providing specific security policies that allow customers to pin connections to post-quantum groups, avoiding the negotiation overhead entirely for known compatible clients. When comparing the two, Cloudflare’s automated edge tuning provides a more consistent “out-of-the-box” experience for general web traffic, while AWS offers the tools necessary for engineers to manually tune performance for specific, high-bandwidth application-to-application traffic.
8. Pricing: What Post-Quantum Protection Costs on Each Platform
One of the most positive developments in the 2026 security landscape is that neither Cloudflare nor AWS has introduced a direct surcharge for post-quantum encryption. Cloudflare has integrated the technology into every plan level, from the free tier used by personal blogs to the enterprise contracts used by major corporations. This “security for everyone” approach is intended to prevent a fractured internet where only the wealthiest organizations are protected against future quantum threats. By making the upgrade free, Cloudflare has ensured that the transition does not become a financial burden for its customers, which has been a major factor in the high adoption rates observed across its network. The cost of the additional bandwidth and CPU cycles is absorbed into the existing subscription fees, reflecting the company’s view of post-quantum cryptography as a standard infrastructure requirement rather than a premium feature.
AWS similarly includes post-quantum support as part of its standard service offerings, with no documented line-item fees for enabling ML-KEM in KMS, Secrets Manager, or other supported endpoints. Customers still pay the standard rates for service usage, such as the cost per API call in KMS or the hourly rate for a Load Balancer, but the cryptographic upgrade itself does not change the billing structure. This pricing model encourages customers to adopt the more secure protocols as they update their SDKs and infrastructure code, as there is no financial disincentive to doing so. The only “cost” involved is the engineering time required to test and deploy the updates, which varies depending on the complexity of the customer’s environment. This lack of a price barrier has been crucial in moving the industry forward, as it allows organizations to prioritize security based on risk assessments and regulatory requirements rather than budget constraints.
9. Real-World Deployments: Who’s Already Running This
Production-scale deployments of post-quantum cryptography are no longer a rarity in 2026, with tens of billions of connections being secured daily. Cloudflare’s global edge is perhaps the most visible example, where the company protects around 45 billion connections every day between its network and origin servers using automatic hybrid negotiation. This has provided a massive boost to the security of the public web, as a significant portion of all internet traffic now benefits from quantum resistance without any explicit action from the site owners. Additionally, Cloudflare One has successfully extended this protection to enterprise customers, allowing them to secure their internal corporate networks and IPsec tunnels against harvesting attacks. These deployments have proven that post-quantum cryptography can be integrated into high-volume, low-latency environments without causing the widespread outages that some critics had feared during the early stages of the NIST competition.
On the AWS side, the deployments are more focused but equally significant, particularly within the financial and public sectors. Major banks and government agencies are already using the hybrid ML-KEM support in AWS Secrets Manager and KMS to protect their most sensitive data and long-lived credentials. By updating their Lambda functions and containerized workloads to use the latest AWS-LC-powered SDKs, these organizations have established a quantum-resistant layer for their internal service-to-service communication. The AWS Transfer Family has also seen significant adoption among companies that handle large-scale managed file transfers, as the new security policies allow them to satisfy regulatory requirements for post-quantum encryption in SFTP and SSH sessions. These real-world examples demonstrate that the technology is mature enough for mission-critical workloads, providing a clear path forward for other organizations that are still in the planning stages of their own cryptographic migrations.
10. Where Google Cloud, Azure, and the Browsers Stand
The broader ecosystem has largely converged around the same standards, with Google Cloud and Microsoft Azure both making significant strides in their own post-quantum rollouts. Google has been a pioneer in this space, having run some of the earliest large-scale tests of post-quantum key exchange in Chrome and on its own internal networks. By 2026, Google Cloud services have widely adopted ML-KEM, particularly within their internal infrastructure and for some public-facing APIs. Microsoft Azure has taken a similar path, integrating post-quantum support into its cryptographic libraries and offering it through its certificate and key management services. While these providers may not always publish the same level of granular adoption data as Cloudflare, their participation in the NIST process and their support for the finalized standards ensure that the industry is moving in a unified direction, reducing the risk of vendor lock-in for customers who prioritize security.
Browser support has been the final piece of the puzzle, with Chrome, Firefox, and Safari all enabling the X25519MLKEM768 hybrid group by default in their 2025 and 2026 releases. This widespread client-side support is what makes the server-side upgrades from Cloudflare and AWS actually useful, as it allows the majority of modern web users to negotiate post-quantum connections automatically. The coordination between browser vendors and cloud providers has been exceptionally tight, with both sides working together to solve issues like the “HelloRetryRequest” latency problem and to ensure that the increased packet sizes don’t break middleboxes or legacy network equipment. This ecosystem-wide readiness has reached a tipping point in 2026, where post-quantum cryptography is no longer an experimental feature but a core component of the modern web’s security architecture, supported by a diverse array of software and hardware vendors.
11. Transitioning Your Infrastructure to Quantum-Resistant TLS: A Step-by-Step Guide
The first phase of a successful migration involves a thorough audit and preparation of the existing technical stack to ensure compatibility with modern standards. Organizations should begin by cataloging every TLS termination point, load balancer, and API gateway in their production environment, specifically documenting whether each point utilizes the older TLS 1.2 or the more modern TLS 1.3, which is a prerequisite for most post-quantum implementations. Next, engineers must verify client-side compatibility by ensuring that application dependencies are updated to use libraries like OpenSSL 3.2+ or Go 1.23+, both of which include native support for ML-KEM. For those utilizing Cloudflare, it is essential to navigate to the PQC status dashboard and confirm that the “Automatic Key Exchange” feature is enabled to protect the path to origin servers. On the AWS side, this phase requires updating to the latest versions of the Secrets Manager Lambda extension (v19+) and Workload Credentials Provider (v2.0.0+) to ensure that hybrid key exchange is prioritized for all internal service calls. Finally, for managed file transfers, AWS Transfer Family endpoints should be transitioned to the TransferSecurityPolicy-2025-03 to secure SSH and SFTP sessions.
Once the initial configuration is in place, the focus shifts to testing, deployment, and ongoing maintenance to ensure long-term stability and compliance. This starts with executing detailed latency testing in a staging environment to measure the handshake duration before and after the update, with a specific focus on identifying and eliminating “HelloRetryRequest” events that can cause performance lag. The production rollout should follow a phased release strategy, allowing teams to monitor connection success rates incrementally and ensure that older clients still have a functioning classical fallback. Simultaneously, organizations need to develop a separate strategy for digital signatures, transitioning to algorithms like ML-DSA or SLH-DSA as the certificate authority landscape matures. It is also vital to align these internal milestones with regulatory mandates such as CNSA 2.0 to ensure that compliance is maintained throughout the decade. Finally, the migration should be treated as an ongoing process, with yearly audits scheduled to review the cryptographic posture against evolving NIST recommendations and updated provider support levels, ensuring the infrastructure remains resilient against new security threats.
12. Cloudflare: Pros and Cons
Cloudflare’s primary advantage in the post-quantum landscape of 2026 is its “zero-effort” deployment model, which provides immediate protection for millions of sites without requiring any manual configuration by the site owners. This network-wide approach has made Cloudflare the single largest driver of post-quantum adoption on the internet, effectively raising the security floor for the entire web. The company’s focus on performance optimization, particularly its successful reduction of handshake retries, ensures that this security boost does not come at a significant cost to user experience. Additionally, the inclusion of post-quantum support across all plan tiers, including the free tier, aligns with Cloudflare’s broader mission to build a better, more secure internet. For organizations that need to secure public-facing web applications or a distributed workforce using SASE tools, Cloudflare offers the most comprehensive and easiest-to-implement solution currently available.
However, the Cloudflare model also has limitations that may be a drawback for certain enterprise use cases. Because the company prioritizes broad adoption and simplicity, its post-quantum implementation is currently limited to TLS 1.3 and HTTP/3, which leaves older legacy traffic on TLS 1.2 without the same level of protection. Customers also have less granular control over the specific cryptographic parameters compared to a more customizable environment like AWS. While the “default-on” strategy is excellent for the majority of the web, it may not satisfy the needs of highly specialized organizations that require deep auditability of every single cryptographic operation or those who need to support complex legacy protocols that Cloudflare has chosen not to prioritize in its post-quantum rollout. Furthermore, the reliance on Cloudflare to manage the TLS termination means that customers must trust the company’s internal security and key-management procedures, which, while robust, represents a centralized point of failure.
13. AWS: Pros and Cons
The strength of Amazon Web Services lies in its granular control and deep integration with enterprise compliance frameworks. By building its post-quantum support on the FIPS 140-3 validated AWS-LC library, Amazon provides a level of assurance that is critical for government, defense, and high-finance sectors. The service-by-service rollout allows engineers to implement post-quantum security exactly where it is needed most, such as in the management of secrets or the handling of sensitive file transfers, without necessarily affecting every part of their infrastructure at once. This model also allows for more complex configurations, including support for post-quantum key exchange in some legacy-compatible environments that Cloudflare’s edge-based model does not cover. For organizations that have built their entire application stack on AWS, the ability to harden the underlying identity and encryption layers using familiar SDKs and security policies is a major operational benefit.
The downside to the AWS approach is the significant amount of engineering effort required to actually achieve full post-quantum protection. Unlike Cloudflare’s automated model, AWS requires customers to proactively update their libraries, extensions, and policies across their entire fleet of services. For a large organization with hundreds of AWS accounts and thousands of microservices, this can be a daunting task that takes months or even years to complete. This “opt-in” model inevitably leads to a much slower adoption rate and leaves many smaller or less technically sophisticated customers unprotected. Additionally, the lack of a centralized dashboard showing the post-quantum status of all traffic—similar to what Cloudflare provides—makes it harder for security teams to get a high-level view of their organization’s overall progress. AWS offers the better tools for the expert user who needs precision and compliance, but it requires much more “heavy lifting” to reach the same level of global coverage that Cloudflare provides out of the box.
14. Which Platform Fits Your Use Case
The choice between Cloudflare and AWS for post-quantum protection in 2026 depends largely on where the most critical data resides and who controls the connection endpoints. For public-facing websites, APIs, and general internet traffic, Cloudflare is the clear leader because of its ability to enforce post-quantum standards at the network edge with minimal performance impact. It is also the superior choice for organizations implementing Zero Trust and SASE strategies, as it can secure the entire path for remote employees and branch offices through a single, unified platform. If an organization’s primary goal is to protect its external reputation and prevent the harvesting of visitor data, Cloudflare provides the fastest and most efficient path to achieving that objective. Its automated tuning and “default-on” posture make it ideal for teams that want to move quickly without getting bogged down in the minutiae of cryptographic configuration.
On the other hand, AWS is the preferred platform for organizations that are primarily concerned with securing internal application logic, managed databases, and back-end service communication. For teams running complex microservices architectures, the post-quantum support in AWS KMS and Secrets Manager is indispensable for protecting the foundational keys and credentials that power their cloud environment. Similarly, AWS is the natural choice for any workload that must comply with strict federal standards like FIPS 140-3 or specific regulatory mandates that require manual verification of the cryptographic stack. The service-by-service model allows these organizations to move at a pace that matches their own internal compliance and testing cycles. Ultimately, many large enterprises will find that they need both: Cloudflare to protect the “front door” of their public web presence and AWS to harden the “inner sanctum” of their application and data infrastructure.
15. The Verdict: Who’s Actually Ahead
The state of post-quantum cryptography in 2026 was defined by a transition from experimental standards to large-scale production reality, and the two leaders in this space achieved success through very different philosophies. Cloudflare successfully demonstrated the power of the network effect, using its position as a central hub for internet traffic to push the entire industry toward more secure defaults. By automating the migration and absorbing the performance costs, the company protected millions of sites and billions of users who might otherwise have been left vulnerable to future quantum threats. The data confirmed that Cloudflare’s aggressive rollout strategy was the single most effective factor in increasing global post-quantum TLS adoption, proving that infrastructure-level changes are the most efficient way to secure the public web. This approach prioritized speed and reach, effectively future-proofing a significant portion of the internet’s traffic well ahead of the most conservative regulatory timelines.
Amazon Web Services, meanwhile, focused its efforts on depth and compliance, providing the rigorous cryptographic tools required by the world’s most demanding organizations. By prioritizing FIPS-validated libraries and service-specific integrations, AWS ensured that the most sensitive data in the world, stored in its KMS and Secrets Manager systems, was the first to receive protection. While its overall adoption numbers appeared lower due to the opt-in nature of its services, the quality and auditability of its implementation met a standard that was often required for national security and high-value financial transactions. Engineers who utilized AWS’s tools in 2026 were able to build highly customized and compliant security architectures that were precisely tuned to their specific needs. Looking back, the industry did not pick a single winner; instead, it benefited from having two complementary models that addressed different segments of the security landscape, ensuring that both the public web and private enterprise clouds were ready for the challenges of a quantum-capable future.
