Cloudflare cuts origin HelloRetryRequests from 52% to 3.7%
Cloudflare AKE cuts origin HelloRetryRequests from 52% to 3.7%
Cloudflare's Automatic Key Exchange probes each origin to learn which key agreement algorithms it supports, then leads with the best one on the first try, preferring the post-quantum hybrid X25519MLKEM768. The rollout dropped HelloRetryRequests from roughly 52% to 3.7% and cut more than 150 ms off handshake latency at p90, while hundreds of thousands of domains now get post-quantum origin connections with no manual configuration.
Somewhere right now, an adversary is recording encrypted traffic it can't read yet, betting that it will be able to in the future.
- londons_explore
Great. Next can cloudflare stop providing Https to the user (giving the impression of security) when the connection back to the origin isn't strict HTTPS and is often plaintext?
- sandeepkd
TLDR;
1. The TLS handshake involves a step to discover the commonly supported algorithms and can incur additional roundtrip if the first guess does not works out, its part of the protocol to keep it stateless
2. Cloudflare is scanning all the origins on daily basis and storing the result for supported algorithms to save on the possible roundtrip time
Whats missing in the article
- They are saving on the *possible roundtrip latency, however they are not sharing the absolute lookup latency which now gets added to every connection
- chrismorgan
Genuine question: why wouldn’t they have been doing this already? It feels like obvious low-hanging fruit on a critical path, so I presume there’s something more to it than I’m imagining.
- LoganDark
Ever since http2 and especially http3 (my god did that take years to reach the mainstream), I've been sad to see intermediaries like Cloudflare gobbling up all the newest protocols and ciphersuites and etc while open source lags behind. The separation has reached years, there's years between new security measures implemented by Cloudflare and when it'll be available to independent server operators. It is getting progressively harder to stay current because you are fighting against an entity with vastly more resources and with far more of an incentive to remain the easiest way to get there. With Cloudflare you get all the latest http server protocols and versions, all the latest everything ciphers TLS everything, and all in exchange for letting them MitM your traffic. I've leaned on them myself too because there is just no way to get that stuff for myself these days. h2o was the only readily available http3 software for years.
- greatgib
2 things comes to my mind reading this article:
1) So they saved 15ms on the connection so that you can then wait 20s in their annoying nag screen before reaching the real website content.
2) On the Monday they complain about the load on server by LLM scrapings compulsively your webserver an offer themselves as the internet guardian solution; and on Tuesday, they compulsively send useless requests to your servers so that they can save a few microseconds in the very first connection ever to your server.
"For each TLS 1.3 capable origin, we run a series of a few lightweight TLS handshakes, each offering exactly one key agreement group: X25519, P-256, P-384, P-521, or X25519MLKEM768. [...] And because the active scanning happens outside your production traffic path, we confirm that both your origin and the network in between can handle connections with a stronger key agreement before any real traffic depends on it.