Cloudflare: Quantum Computers Could Forge Privacy Pass Tokens but Not Break User Privacy, and MOLE Is Its Next Step

What happened

In a post published on November 6, 2026, Cloudflare said Privacy Pass is a protocol that site operators such as Cloudflare use to protect applications from abuse. One approach is rate limiting: restricting individual clients so that no single client consumes too many of a site's resources.

Cloudflare says traditional anti-abuse methods usually cost users something: either solving a challenge such as a CAPTCHA, or logging in or being identified. Privacy Pass lets a client obtain multiple tokens (think of them as digital passes) and redeem them to access a site. No token can be linked back to the person who obtained it, so users need not trade smooth access for privacy.

Cloudflare says it has 10 years of deployment experience, for example in privacy proxy services such as iCloud Private Relay, and is working with others on the next generation of the technology. Goals include managing AI agent traffic that may consume excessive resources and making it easier for more types of clients to take part.

How quantum computers affect Privacy Pass

According to Cloudflare, Privacy Pass still relies on classical cryptography such as RSA and elliptic curves. Once quantum computers capable of breaking this cryptography exist, a quantum attacker could forge tokens at will and bypass protections such as rate limiting. Cryptography that resists quantum attacks is called post-quantum cryptography.

Cloudflare also says Privacy Pass has unconditional privacy: whether or not an attacker has a quantum computer, they cannot link a token redemption to its original issuance. Cloudflare adds that the new features under development will keep the same guarantee.

What MOLE is

Cloudflare says the new technology is currently called MOLE (Moderation Of unLinkable Endorsements). In MOLE, an endorsement is issued by an anchor (a trusted issuer) and then redeemed by a moderator. The client only needs to prove that the endorsement it holds comes from one of the anchors on a trusted list, without revealing which one.

Cloudflare says MOLE deliberately hides the issuer's identity so that the system cannot treat tokens differently by issuer. This ensures different types of clients are treated equally and makes it easier for more clients to join.

Post-quantum options and cost estimates

Cloudflare notes that the main challenge for post-quantum schemes is data size. For digital signatures, the post-quantum ML-DSA-44 signature is 2,420 bytes, while a classical ECDSA-P256 signature is only 64 bytes, and there is no drop-in replacement in the near term.

The post describes PoMFRIT, presented by Baum et al. at USENIX Security 2026. It is a blind signature: the issuer signs for the client without seeing the content, and afterward cannot match the signature to the original issuance. PoMFRIT's blind signature is 6.7KB, and issuance takes only a few hundred bytes. Cloudflare says that using a signature scheme called UOV (Unbalanced Oil and Vinegar), the signature can shrink to 4.3KB, but public keys (the published part of a key that others use to check signatures) become larger. UOV is a form of multivariate cryptography whose security rests on the difficulty of solving systems of multivariate quadratic equations, which is generally believed to be hard even for quantum computers.

Cloudflare says each operation takes only a few milliseconds in its implementation. The added overhead of replacing RSA blind signatures with PoMFRIT is roughly comparable to replacing ECDSA with ML-DSA.

Limitations and open work

• Cloudflare says attack research (cryptanalysis) on multivariate cryptography is still relatively immature, so parameters may change and costs may increase.
• Cloudflare still needs to provide security proofs showing that these protocols are secure as long as UOV is secure.
• Optimizations that reduce the number of hash operations (calculations that turn data into a short fixed-length fingerprint) rely on a stronger one-more-UOV assumption, which Cloudflare says may be too optimistic. If the assumption were broken, the impact would be on whether tokens can be forged, not on client privacy.
• Cloudflare mentions that researchers at UC San Diego and INRIA forged a 1024-bit RSA signature by using a Privacy Pass issuer to sign for them. Cloudflare says Privacy Pass uses 2048-bit RSA, which together with other defenses provides a good security margin.
• Cloudflare says classical blind signatures may be cheap enough to redeem once per request, while post-quantum versions will need a way to let one redemption cover multiple requests.

Browse the latest news in this topic

• Tech news