Cloudflare推出了自动密钥交换（Automatic Key Exchange）功能，该功能通过主动扫描源服务器来识别其支持的密钥协议，从而改进TLS连接性能1。这一方案替代了此前基于静态猜测的方式，使得HelloRetryRequest的发生比例从约52%大幅下降至3.7%1，同时减少了超过150毫秒的连接握手延迟（P90测量值）1。
该功能已自动为数十万个域名启用后量子混合密钥交换（X25519MLKEM768），无需用户手动配置1。在当前扫描范围内，12.8%的源服务器支持后量子密钥交换1，已有超过100万个域被分配了密钥交换偏好1。统计显示，约64%的域保持使用经典X25519，33%升级到X25519MLKEM768，3%选择其他经典曲线1。得益于这一优化，99.2%的后量子TLS 1.3连接现在可在单个往返中完成1。
该功能部署以来，每日源连接数已从约25亿增至45亿条1。Cloudflare表示，其目标是到2029年使互联网量子安全1。
Cloudflare has launched an Automatic Key Exchange (AKE) feature that proactively scans origin servers to identify supported key protocols, replacing the previous approach of static protocol guessing.1 This mechanism reduces HelloRetryRequests from approximately 52% to 3.7%, while cutting connection handshake latency by more than 150 milliseconds at the p90 percentile.1 The technology automatically enables post-quantum hybrid key exchange using X25519MLKEM768 across hundreds of thousands of domains without requiring manual configuration.1
The deployment has significantly expanded Cloudflare's scanning scope, with daily origin connections increasing from roughly 2.5 billion to 4.5 billion.1 Among scanned origins, 12.8% now support post-quantum key exchange, and 99.2% of post-quantum TLS 1.3 connections are completed in a single round trip.1 Over one million domains have been assigned key exchange preferences, with approximately 64% retaining the classic X25519 protocol, 33% upgrading to X25519MLKEM768, and 3% selecting other classical curves.1 The X25519MLKEM768 key shares require 1,216 bytes compared to just 32 bytes for X25519.1 Cloudflare has stated an objective to make the internet quantum-safe by 2029.1
评论
还没有评论，欢迎留下第一条。