Bas Westerbaan

When a broken DNSSEC rollover took down the .AL top-level domain, we deployed a Negative Trust Anchor on 1.1.1.1 to keep sites reachable. Now, clients do not have to guess if validation was skipped: 1.1.1.1 returns EDE 33, a new error code signaling that validation was temporarily skipped. cfl.re/4hd8nXa

@FutureDies Of course: TLS was built with extensibility in mind. That's why we can add ML-DSA today.

@bwesterb Or we don't put all eggs in one basket and design systems that can support multiple schemes! (mostly concerns blockchains)

Why we cannot wait for better post-quantum signature algorithms: ML-DSA will have to do. But searching for better is still important! blog.cloudflare.com/ml-dsa-will-ha…

@iamspi_ bas.westerbaan.name/notes/2026/06/…

@iamspi_ If people can agree on the hybrid, yes, but if people can’t agree I think it’s better to go with plain MLDSA so that we at least have quantum security.

Incredible write-up but tbh I didn't read all that. What I really want answerd though is how do we avoid a fragmented PQC migration across blockchains? If one chain adopts Falcon, another ML-DSA, etc, interoperability and standardization become tricky.

@YuviLightman ML-DSA-44 already has quite a healthy margin (32 bits!) above 128 bits.

Great writeup on the zoo of post-quantum crypto schemes. CloudFlare’s conclusion: don’t overthink it, just use ML-DSA. Quantus agrees. If you’re worried about lattice cryptanalysis advancing, choose a higher security level. That’s why quantus uses ML-DSA-87.

@thechajo @Cloudflare It's out there today!

@Cloudflare I gotta learn this post quantum stuff, it’s the future

NIST is advancing nine new post-quantum signature algorithms as potential candidates for future standardization. We take a closer look at all of them, and argue that while they are in the works and show great potential, we should use ML-DSA for now. cfl.re/4h1fIJh

@DigitalVagrant @Cloudflare ML-DSA is great.

@Cloudflare I wonder if this will be as good as the NIST curves? 👀

@nic_carter I'm shouting, but are they listening?

@bwesterb Would you kindly tell the Bitcoin developers this. They seem to think that there is much to be gained by waiting.

My take: the future of privacy is multivariate. Cryptographers, prove me wrong.

@gojimmypi @Cloudflare @hashbreaker I prefer hybrid, but it's useless if we can't agree on *which* hybrid. As it stands, despite my best attempts, there is no agreement on which hybrid to use in the WebPKI. Other ecosystems have done better: SSH converged on a hybrid which is great.

@bwesterb @Cloudflare @hashbreaker @bwesterb I think the part that got me was "or at all". Do you believe there should be no hybrid at all?

@gojimmypi @Cloudflare @hashbreaker So you're proposing we provision 16 certificates on each server? bas.westerbaan.name/notes/2026/06/…

@Cloudflare @bwesterb @hashbreaker For more information, this resource was included: keymaterial.net/2026/06/18/on-…

Wait, Scott Aaronson is an investor?

The US is now requiring high value / high impact information systems to be quantum-secure by ~2031 instead of 2035: whitehouse.gov/presidential-a… IMO this is an improvement. Security shouldn't be contingent on progress in quantum computers being slow.

@Cheema3Santhosh This is the earliest realistic date for the government to get it done. If you can you should move faster. blog.cloudflare.com/post-quantum-r…

@bwesterb Damn sooner than expected

New US executive order signed pulling ahead deadline for PQC migration from 2035 to 2031. No text online yet, but will add once it's out.

Also CMVP is going to be revised "(i)  the term “Cryptographic Module Validation Program” has the same meaning as it has in FIPS 140-3, “Security Requirements for Cryptographic Modules,” or any successor policy"

There is reason to. blog.cloudflare.com/post-quantum-r…