Cloudflare Maps a Post-Quantum Path for Privacy Pass Credentials
Cloudflare's MOLE design would keep Privacy Pass tokens unlinkable after quantum computers arrive, using blind signatures built from VOLE-in-the-Head proofs and UOV keys.
TL;DR
- Privacy Pass is a protocol that lets a site issue a client unlinkable tokens, so an operator can rate-limit traffic without tracking the person behind each request.
- Cloudflare has run Privacy Pass in production for 10 years and published on 6 November 2026 a design study for its post-quantum successor, under the working name MOLE.
- Today's tokens use RSA and elliptic-curve blind signatures. A cryptographically relevant quantum computer could forge them.
- MOLE adds an endorsement issued by an anchor and redeemed by a moderator, and the client proves possession of an endorsement issued by one anchor in the agreed set without revealing which anchor issued it.
- The construction comes from VOLE-in-the-Head, a proof system that a prover can turn into a signature, and the PoMFRIT blind signature built on it shrinks to 4.3KB when UOV replaces MAYO.
- Cloudflare estimates 5.6KB of issuance for VOLE-IHAT and 5.4KB for VOLE-ACT, with 6.5KB and 12.0KB at redemption, against 46.6KB public keys.
- The costs and the open questions are concrete: multivariate cryptanalysis is young, security proofs are still missing, and each of these operations already runs in a few milliseconds.
- Deployment depends on two items Cloudflare still lists as work, a security proof for the new protocols and maturity in the cryptanalysis of the multivariate schemes underneath them.
What Privacy Pass issues, and where RSA sits in it
Privacy Pass lets a site rate-limit traffic without linking a redeemed token to the client that received it. A site that wants to stop one client consuming its capacity reaches for challenges, accounts or fingerprinting, and each of those costs the visitor something. Privacy Pass issues the client a number of tokens that the client redeems for access, while each token stays unlinkable to the client it was issued to.
Cloudflare has deployed this for 10 years across products such as iCloud Private Relay and Privacy Gateway, and the post lists two goals for the next generation: better tools for managing agentic traffic that would otherwise eat capacity meant for people, and an ecosystem where more kinds of clients can participate. Both goals run into the same cryptographic obstacle, because the tokens are minted with RSA or elliptic-curve blind signatures and a quantum attacker could forge them at will.
Privacy Pass remains unconditionally private through this change. That guarantee means no attacker, quantum or classical, can link a redemption to an issuance. The post quantifies the size constraint: ML-DSA-44 signatures are 2,420 bytes; ECDSA-P256 signatures are 64 bytes.
MOLE adds an endorsement that hides its issuer
A Privacy Pass token today carries a message and a blind signature, and verifying it requires the issuer's public key, so the verifier learns who issued the token. The issuer's identity provides a decision signal in some products. Many access decisions require only proof that a trusted entity issued the token, an observation that shapes MOLE.
The new object is an endorsement, issued by an anchor and redeemed by a moderator. Before redemption the client and moderator agree on an anchor set, the public keys the moderator trusts, and during redemption the client proves that one anchor in that set endorsed it without revealing which one. The moderator then issues the credential the client uses, and because that credential belongs to one moderator it can be a blind signature, an anonymous credit token or an anonymous rate-limited credential.
The design goal is equal treatment. If a moderator cannot tell which anchor signed, it cannot price or gate a client by the reputation of its issuer, which lowers the barrier for new kinds of clients. Verifying the endorsement keeps the signer unnamed, and that is the part the post spends most of its length on.
VOLE-in-the-Head turns a proof into a signature
VOLE-in-the-Head is a zero-knowledge proof system published by Baum and others at Crypto 2023, and its name describes the mechanism. Vector Oblivious Linear Evaluation is an interactive technique that hands two parties correlated random values, and those correlations act as authentication tags that let a verifier check work done on a hidden witness. In the head version the prover prepares locally what the two parties would normally generate together, commits to those values, and uses the Fiat-Shamir transformation to pick the parts the verifier checks.
Cloudflare presents this adaptable proof system as a way to decouple post-quantum parameter selection from credential protocol design; its proofs grow linearly with the size of the witness and are concretely fast for statements expressed as equations over small binary fields. That covers two useful cases. FAEST proofs about an AES key run to about 4KB, and KuMQuat signatures, which prove an instance of the multivariate quadratic problem, come down to 2.6KB.
The second ingredient is a multivariate signature scheme with a trapdoor. In Unbalanced Oil and Vinegar the public key is a quadratic map, the secret key reveals a split of the variables into oil and vinegar, and fixing the vinegar values leaves a linear system the signer can solve. UOV signatures are 135 bytes, among the smallest of the NIST candidates, and its public keys are 46.6KB, the largest; MAYO offers much smaller keys in exchange for slightly larger signatures.
Blind signatures from VOLE and UOV reach 4.3KB
A blind signature is built from a commitment and a proof. The client hashes its message with randomness and sends the commitment, the issuer signs that commitment without learning the message, and the client later produces a zero-knowledge proof that it holds a valid signature over the commitment. Unlinkability comes from the client showing two different objects at the two moments, so an issuer that also acts as verifier cannot match the sessions.
PoMFRIT, published by Baum and others at USENIX Security 2026, applies that pattern with VOLE-in-the-Head and the MAYO signature, and it reached 6.7KB for the blind signature itself with a few hundred bytes of issuance. The UOV variant brings the signature to 4.3KB and uses a larger public key that an application can cache. The post describes the Keccak permutation inside SHAKE and TurboSHAKE as the dominant cost, two permutations per proof, and cuts it by dropping to 12 rounds and halving the Keccak state.
Endorsements then extend the same machinery. The statement gains a public key drawn from a list of anchors, the index of the chosen anchor becomes part of the hidden witness, and the proof carries the same two hashes and one quadratic map evaluation. Cloudflare says the cost of the more advanced credentials is one or two extra hashes.
The published costs of the new credentials
The two constructions Cloudflare is developing have published estimates. VOLE-IHAT, a candidate for endorsements, costs 5.6KB at issuance and 6.5KB at redemption. VOLE-ACT, a candidate for credentials, costs 5.4KB at issuance and 12.0KB when a credit is spent. Every construction in this framework uses UOV with the same parameters, so public keys are 46.6KB each, and each operation runs in a few milliseconds in Cloudflare's implementation.
Those numbers support the post's own conclusion, which is that "the transition to PQ anonymous credentials for the web can now shift from cryptography design to protocol engineering". Netics' assessment is that this transition is operationally plausible for deployments that can distribute and cache a 46.6KB public key and reuse one redemption across several requests. Each anchor adds its own key to the trusted set, making key distribution and cache lifecycle part of the deployment cost. Short, one-request interactions offer little opportunity to amortize a 6.5KB redemption or a 12.0KB spend. The missing security proofs and immature multivariate cryptanalysis keep the design at the engineering-prototype stage: parameter changes may increase these costs, and production migration should wait for proofs and stable parameters. Cloudflare's millisecond runtimes make experimentation credible.
Two risks in front of deployment
Two risks sit in front of deployment. The first is cryptanalysis: multivariate schemes are young, and the post recalls researchers at UCSD and INRIA forging a 1024-bit RSA signature by using a Privacy Pass issuer as a signing oracle; Cloudflare says its 2048-bit RSA parameters provide a good security margin when combined with other defense mechanisms. The second is proof: the protocols need security proofs showing they hold as long as UOV holds, and the one-more-UOV assumption that the optimization relies on could prove optimistic.
For teams running access control on tokens today, the sequence is legible. Keep classical Privacy Pass in production while the primitives settle, count the token budget in kilobytes where it used to be counted in bytes, and treat the ability to amortize a redemption as a product decision. The Netics piece on Cloudflare's post-quantum certificate authority covers the certificate layer of the same transition. For infrastructure and cloud planning, teams must budget for public-key distribution, token size and the number of requests covered by each redemption.
Sources
Source: the Cloudflare blog post "The post-quantum future of web privacy" by Christopher Patton, Tianyu Zhang and Bas Westerbaan, published 6 November 2026 and read in full on 7 November 2026. Every size, mechanism and quotation above, including the 2,420-byte ML-DSA-44 signature, the 6.7KB PoMFRIT result and the 4.3KB UOV variant, comes from that post.