Post-Quantum Web Privacy: How Privacy Pass and MOLE Could Adapt

Cloudflare has started thinking seriously about web privacy in the post-quantum era, and the outlook is fairly reassuring. So far, the transition in cryptography has focused on foundational protocols like TLS. Yet plenty of other systems still depend on quantum-vulnerable cryptography, including Privacy Pass, a protocol site operators use to protect applications from abuse.

Privacy Pass: limiting traffic without sacrificing privacy

Site operators like Cloudflare often use rate limiting so that no single client consumes too many resources. This usually comes with friction or a loss of privacy: CAPTCHAs, other challenges, accounts, even fingerprinting. Privacy Pass was designed to avoid that tradeoff.

The idea is that a client receives a number of tokens that can be redeemed for access to a site. Each token can't be linked back to the client it was issued to, so users can keep using the site as usual without giving up their privacy.

Cloudflare has 10 years of experience deploying Privacy Pass for privacy proxies (like iCloud Private Relay) and relays (like Privacy Gateway). Now, together with others, it is preparing the next generation. One goal is better tools for managing agentic traffic, which would otherwise consume too many resources and degrade performance for human visitors. Another is a more open ecosystem, where more types of clients can take part.

Web privacy in the post-quantum era

Privacy Pass currently still relies on classical cryptography such as RSA and elliptic curves. That means an attacker with a quantum computer could forge tokens at will and bypass whatever security mechanism the site operator has put in place, including rate limiting. On the other hand, Privacy Pass is unconditionally private: no attacker, quantum or not, can link the redemption of a token to its issuance. The new capabilities being developed for the next generation will be built with the same guarantee, so your interactions stay private even after Q-day.

That guarantee buys some breathing room, but an alternative is still needed soon. Research in this area has advanced quickly, yet the main challenge is the same as in other parts of the transition: size. The comparison is striking:

• ML-DSA-44 signatures: 2,420 bytes
• ECDSA-P256 signatures: 64 bytes

There is also no drop-in replacement in sight. As with TLS, we will have to accept primitives with a higher cost and re-engineer systems to bear it. Cloudflare explores one possible future made possible by a recent breakthrough in the design of blind signatures.

Meet MOLE

That new technology is called MOLE, short for Moderation Of unLinkable Endorsements. A core component of Privacy Pass is a blind signature scheme, which lets a client get a signature under an issuer's secret key without revealing the message being signed. Later, the client can reveal the message and signature without it being traceable to the issuance. But to verify this type of token, the verifier needs the issuer's public key, so the issuer's identity is exposed. The client's identity is protected, the issuer's is not.

For some use cases, that is exactly what's needed. For example, a client might use a token issued by a Cloudflare customer to prove it is authorized to use that customer's VPN product. In many other cases, though, it's more information than necessary, since all that matters is that the token came from an entity that is trusted. MOLE goes a step further by hiding the issuer's identity altogether, so tokens can't be treated differently based on who issued them. The result is equal treatment for every type of client, and an easier path for more clients to participate.

This issuer-hiding property comes from a new object called an endorsement. An endorsement is issued by an anchor and redeemed by a moderator. Before redemption, the client and moderator agree on an anchor set, the public keys of the anchors the moderator trusts. During redemption, the client proves it received an endorsement from one of the anchors in the set without revealing which one. If accepted, the moderator issues a MOLE credential, which is used to moderate the client's interaction with the site.

For site owners and service operators who rely on rate limiting and anti-bot measures, the risk of quantum token forgery is still a future concern. The good news is that user privacy is protected by the basic design, and the research direction toward post-quantum versions is clear. What to watch is the much larger signature size, since it will shape how these systems are built.